Exam AWS Certified Security - Specialty topic 1 question 265 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 265
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A company is developing an ecommerce application. The application uses Amazon EC2 instances and an Amazon RDS MySQL database. For compliance reasons, data must be secured in transit and at rest. The company needs a solution that minimizes operational overhead and minimizes cost.
Which solution meets these requirements?

A. Use TLS certificates from AWS Certificate Manager (ACM) with an Application Load Balancer. Deploy self-signed certificates on the EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Enable encryption of the RDS DB instance. Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that support the EC2 instances.
B. Use TLS certificates from a third-party vendor with an Application Load Balancer. Install the same certificates on the EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Use AWS Secrets Manager for client-side encryption of application data.
C. Use AWS CloudHSM to generate TLS certificates for the EC2 instances. Install the TLS certificates on the EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Use the encryption keys form CloudHSM for client-side encryption of application data.
D. Use Amazon CloudFront with AWS WAF. Send HTTP connections to the origin EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Use AWS Key Management Service (AWS KMS) for client-side encryption of application data before the data is stored in the RDS database.

Show Suggested Answer

Suggested Answer: A 🗳️

by AWee at Aug. 28, 2021, 8:05 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

AWee

Highly Voted 3 years, 9 months ago

A: Correct; different certs for LB and EC2 B: Incorrect; because of same certificates C: Incorrect: HSM is costly D: Incorrect -> HTTP

upvoted 12 times

...

Raphaello

Most Recent 1 year, 4 months ago

Selected Answer: A

Correct answer is A

upvoted 1 times

...

p4v10

2 years, 1 month ago

Selected Answer: A

A is the easiest option here

upvoted 1 times

...

Radhaghosh

3 years, 5 months ago

Option A is valid -> Low cost option.

upvoted 3 times

...

Hariru

3 years, 7 months ago

Selected Answer: A

C is toooo expensive. B is kinda not fulfilling the req with the same cert D could be if it would have been HTTPS! A seems reasonable, also with the correct LB

upvoted 1 times

...