SOA-C02 Question 199
Select 3Your company hosts a critical web application on an Amazon EC2 instance behind an Application Load Balancer. The application stores sensitive customer data in an Amazon RDS database. To meet compliance requirements, you need to implement a data and infrastructure protection strategy to secure the data both in transit and at rest. Which combination of steps should you take to achieve this requirement?
- A
Enable SSL/TLS for data transmission between the clients and the Application Load Balancer.
- B
Configure encryption at rest for the Amazon RDS database using AWS KMS-managed keys.
- C
Use a security group to allow unrestricted inbound access to the Amazon RDS database for convenience.
- D
Enable Amazon S3 Transfer Acceleration to enhance data security for uploads to the RDS database.
- E
Configure HTTPS on the Application Load Balancer and install a valid SSL certificate.
Show answer and explanation
Correct answers: A, B, E
Explanation
To implement a comprehensive data and infrastructure protection strategy, you need to ensure data is secured both in transit and at rest. Enabling SSL/TLS and configuring HTTPS on the Application Load Balancer encrypts data during transmission, while encrypting the RDS database using AWS KMS-managed keys secures data at rest. These measures align with compliance requirements and AWS best practices.
- A. Correct.
Enabling SSL/TLS ensures that data transmitted between clients and the Application Load Balancer is encrypted, protecting it in transit.
- B. Correct.
Encrypting the Amazon RDS database using AWS KMS-managed keys protects sensitive data at rest, meeting compliance requirements.
- C. Incorrect.
Allowing unrestricted inbound access to the RDS database creates a significant security risk and violates best practices for data protection.
- D. Incorrect.
Amazon S3 Transfer Acceleration is not relevant in this scenario as it is used for faster uploads to S3 and does not apply to RDS databases.
- E. Correct.
Configuring HTTPS on the Application Load Balancer with a valid SSL certificate ensures secure communication between clients and the load balancer, protecting data in transit.