Amazon Exam SAA-C03 Topic 6 Question 30 Discussion

Actual exam question for Amazon's SAA-C03 exam

Question #: 30
Topic #: 6

A company has a three-tier environment on AWS that ingests sensor data from its users' devices The traffic flows through a Network Load Balancer (NIB) then to Amazon EC2 instances for the web tier and finally to EC2 instances for the application tier that makes database calls

What should a solutions architect do to improve the security of data in transit to the web tier?

AConfigure a TLS listener and add the server certificate on the NLB

BConfigure AWS Shield Advanced and enable AWS WAF on the NLB

CChange the load balancer to an Application Load Balancer and attach AWS WAF to it

DEncrypt the Amazon Elastic Block Store (Amazon EBS) volume on the EC2 instances using AWS Key Management Service (AWS KMS)

Show Suggested Answer

Suggested Answer: A

A: How do you protect your data in transit?

Best Practices:

Implement secure key and certificate management: Store encryption keys and certificates securely and rotate them at appropriate time intervals while applying strict access control; for example, by using a certificate management service, such as AWS Certificate Manager (ACM).

Enforce encryption in transit: Enforce your defined encryption requirements based on appropriate standards and recommendations to help you meet your organizational, legal, and compliance requirements.

Automate detection of unintended data access: Use tools such as GuardDuty to automatically detect attempts to move data outside of defined boundaries based on data classification level, for example, to detect a trojan that is copying data to an unknown or untrusted network using the DNS protocol.

Authenticate network communications: Verify the identity of communications by using protocols that support authentication, such as Transport Layer Security (TLS) or IPsec.

https://wa.aws.amazon.com/wat.question.SEC_9.en.html

by Cecil at Mar 10, 2024, 03:54 AM

Limited Time Offer

25%

Off

Get Premium SAA-C03 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Mila

7 days ago

Haha, yeah, that's a good point. Option D is definitely a distraction. I'm leaning towards option A myself, as it seems the most direct solution to the problem. And hey, who doesn't love a good old-fashioned TLS encryption? *winks* It's the security equivalent of a warm hug for your data.

upvoted 0 times

...

Natalie

8 days ago

I agree, options A and C both seem like viable choices. Although, I'm not sure if Option D, encrypting the EBS volumes, is really relevant here. That would protect the data at rest, but not the data in transit, which is the focus of this question. *chuckles* Maybe the exam writers are just trying to throw in a red herring to confuse us.

upvoted 0 times

...

Bernardine

9 days ago

Option A does sound like the most straightforward way to secure the data in transit, but I'm also curious about Option C. Changing the load balancer to an Application Load Balancer and attaching AWS WAF could provide an extra layer of protection against web-based attacks. What do you guys think?

upvoted 0 times

...

Norah

10 days ago

Hmm, this is an interesting question. I think the key here is to focus on securing the data in transit to the web tier, which is the weakest link in the architecture. I'm leaning towards option A - configuring a TLS listener and adding the server certificate on the NLB. That should help encrypt the traffic and prevent any eavesdropping or man-in-the-middle attacks.

upvoted 0 times

...