Discuss Amazon SAA-C03 Exam Topic 6 Question 30

A company is building a new web-based customer relationship management application. The application will use several Amazon EC2 instances that are backed by Amazon Elastic Block Store (Amazon EBS) volumes behind an Application Load Balancer (ALB). The application will also use an Amazon Aurora database. All data for the application must be encrypted at rest and in transit.

Which solution will meet these requirements?

AUse AWS Key Management Service (AWS KMS) certificates on the ALB to encrypt data in transit. Use AWS Certificate Manager (ACM) to encrypt the EBS volumes and Aurora database storage at rest.

BUse the AWS root account to log in to the AWS Management Console. Upload the company's encryption certificates. While in the root account, select the option to turn on encryption for all data at rest and in transit for the account.

CUse a AWS Key Management Service (AWS KMS) to encrypt the EBS volumes and Aurora database storage at rest. Attach an AWS Certificate Manager (ACM) certificate to the ALB to encrypt data in transit.

DUse BitLocker to encrypt all data at rest. Import the company's TLS certificate keys to AWS key Management Service (AWS KMS). Attach the KMS keys to the ALB to encrypt data in transit.

Suggested Answer: A

A: How do you protect your data in transit?

Best Practices:

Implement secure key and certificate management: Store encryption keys and certificates securely and rotate them at appropriate time intervals while applying strict access control; for example, by using a certificate management service, such as AWS Certificate Manager (ACM).

Enforce encryption in transit: Enforce your defined encryption requirements based on appropriate standards and recommendations to help you meet your organizational, legal, and compliance requirements.

Automate detection of unintended data access: Use tools such as GuardDuty to automatically detect attempts to move data outside of defined boundaries based on data classification level, for example, to detect a trojan that is copying data to an unknown or untrusted network using the DNS protocol.

Authenticate network communications: Verify the identity of communications by using protocols that support authentication, such as Transport Layer Security (TLS) or IPsec.

https://wa.aws.amazon.com/wat.question.SEC_9.en.html

Get Premium SAA-C03 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

34 comments · newest first

Coleen 11 months ago

C is the way to go, it covers all the encryption needs!

Wai 11 months ago

Definitely not B, using the root account for everything is a bad idea.

Blair 11 months ago

Wait, can you really use the root account for that? Seems risky!

Anjelica 11 months ago

I think A is better for using ACM with the ALB.

Nina 12 months ago

Option C sounds right, KMS for EBS and Aurora is a solid choice.

Timothy 12 months ago

I vaguely recall that BitLocker is more for Windows environments, so option D might not be the best fit for AWS.

Danilo 1 year ago

I feel like option B is definitely wrong; using the root account for everything seems risky and not best practice.

Kimbery 1 year ago

I'm not entirely sure, but I remember something about using ACM for certificates. Is that in option A or C?

Jean 1 year ago

I think option C sounds familiar because we discussed using AWS KMS for EBS and Aurora encryption in class.

Allene 1 year ago

I'm not sure about using the root account to turn on encryption for the whole account. That doesn't seem like the most secure or recommended approach. I'll focus on the individual service-level encryption options.

Daryl 1 year ago

Option A looks good to me. Using KMS and ACM to handle the encryption requirements seems like a reliable and integrated solution. I'll make sure I understand how those services work together.

Darnell 1 year ago

Hmm, I'm a bit confused about the different encryption options here. I'll need to review the details of AWS KMS, ACM, and how they work with the various AWS services mentioned in the question.

Darrin 1 year ago

This seems like a straightforward encryption question. I think option C is the best approach - using AWS KMS to encrypt the EBS volumes and Aurora database, and ACM for the ALB certificate.

Hubert 1 year ago

Hmm, this looks like a tricky one. I'll need to carefully examine the exhibit and the answer choices to determine which statement is false.

Filiberto 1 year ago

Wait, what's the difference between ASR and TTS? I'm a little fuzzy on the details there. Let me review my notes quickly.

Mitsue 1 year ago

This question feels similar to one we did in practice about functionality in services. I think it's "orchestrated task", but I'm not entirely certain.

Mica 1 year ago

I'm a bit confused here. Does the user need full access (read, write, and execute) on both folders to be able to compare the mappings? Or is read permission alone sufficient?

Dominga 1 year ago

I practiced a similar question on Aviatrix's features last week, and I'm leaning towards D, the AWS TGW Orchestrator. It just seems to fit.

Cristal 1 year ago

Haha, nice try with the BitLocker option, but I don't think that's gonna fly in an AWS environment. C is the clear winner here.

Chauncey 1 year ago

BitLocker? Really? That's a Windows feature, not an AWS solution. I think option C is the way to go.

Amber 1 year ago

↳ replying to Chauncey

Option C: Use AWS Key Management Service (KMS) to manage encryption keys for the Amazon EBS volumes and the Amazon Aurora database.

Amina 1 year ago

↳ replying to Chauncey

Option B: Use AWS Key Management Service (KMS) to manage encryption keys for the Amazon Aurora database.

Geoffrey 1 year ago

↳ replying to Chauncey

Option A: Use BitLocker to encrypt the data on the Amazon EBS volumes.

Dorothea 1 year ago

I'm not sure using the root account is a good idea. It's generally recommended to use IAM users for this kind of task.

Laine 1 year ago

↳ replying to Dorothea

Configure SSL/TLS for the ALB to encrypt data in transit.

Javier 1 year ago

↳ replying to Dorothea

Create an IAM role with the necessary permissions for the EC2 instances to access the encrypted data.

Erick 1 year ago

↳ replying to Dorothea

Use AWS Key Management Service (KMS) to encrypt the Amazon EBS volumes and the Amazon Aurora database.

Hillary 1 year ago

Option C looks like the right choice here. It covers the encryption requirements for both data at rest and in transit.

Wai 1 year ago

↳ replying to Hillary

User 3: Yeah, I agree with Wai. Option C seems to be the most comprehensive solution for the encryption requirements.

Kiley 1 year ago

↳ replying to Hillary

User 2: Option C covers both data at rest and in transit encryption, so it seems like the best choice.

Paris 1 year ago

↳ replying to Hillary

User 1: I think Option A could work too, it mentions encryption for data at rest.

Anabel 2 years ago

I'm not sure about option A. I think option C could also work by using AWS KMS to encrypt data at rest and attaching an ACM certificate to the ALB for data in transit.

Arlette 2 years ago

I agree with Leeann. Option A seems to be the most secure and straightforward way to meet the encryption requirements.

Leeann 2 years ago

I think option A is the best solution. Using AWS KMS certificates on the ALB for data in transit and ACM for data at rest makes sense.

Amazon SAA-C03 Exam - Topic 6 Question 30 Discussion