Q91 — AWS SAA-C03 Ch.10

Question 91 of 100 | ← Chapter 10

Q691. To meet security requirements,a company needs to encrypt all of its application data in transit while communicating with an Amazon RDS MySQL DB instance.A recent security audit revealed that encryption at rest is enabled using AWS Key Management Service (AWS KMS), but data in transit is not enabled. What should a solutions architect do to satisfy the security requirements?

Correct Answer: D. Download AWS-provided root certificates. Provide the certificates in all connections to the RDS instance.

Explanation

To satisfy the security requirements of encrypting all application data in transit while communicating with an Amazon RDS MySQL DB instance that already has encryption at rest enabled using AWS Key Management Service (AWS KMS), a solutions architect should:D. Download AWS-provided root certificates and provide these certificates in all connections to the RDS instance.Option D is the correct solution for enabling encryption of data in transit:- Download AWS-provided root certificates: AWS provides root certificates that can be used to establish secure connections to RDS instances.- Provide the certificates in all connections to the RDS instance: By configuring the client applications to use the AWS-provided root certificates, the connections to the RDS instance will be encrypted in transit. This ensures that all application data is securely transmitted between the application and the RDS instance.Option A, enabling IAM database authentication on the database, is not directly related to encrypting data in transit. IAM database authentication is a separate authentication mechanism that allows you to authenticate to an RDS database using IAM user or role credentials.Option B, providing self-signed certificates and using them in all connections to the RDS instance, is not recommended. Self-signed certificates may not be trusted by client applications, leading to potential security vulnerabilities.Option C, taking a snapshot of the RDS instance and restoring it to a new instance with encryption enabled, addresses encryption at rest but does not directly address encryption of data in transit.Therefore, the best solution is D: Download AWS-provided root certificates and provide these certificates in all connections to the RDS instance. This ensures that all application data is encrypted in transit while communicating with the Amazon RDS MySQL DB instance, satisfying the security requirements.