Q63 — AWS SAA-C03 Ch.12

Question 63 of 100 | ← Chapter 12

Q863. A company is running a highly sensitive application on Amazon EC2 backed by an Amazon RDS database. Compliance regulations mandate that all personally identifiable information (PII) be encrypted at rest.Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure?

Correct Answer: D. Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes.

Explanation

To meet the requirement of encrypting personally identifiable information (PII) at rest for a highly sensitive application running on Amazon EC2 backed by an Amazon RDS database with the least amount of changes to the infrastructure, the recommended solution is:D. Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes.Here's why:Option D suggests configuring Amazon EBS encryption and Amazon RDS encryption with AWS KMS keys to encrypt both the instance and database volumes. This solution allows for encryption at rest without requiring significant changes to the infrastructure.By enabling Amazon EBS encryption, the underlying EBS volumes that are attached to the EC2 instances will be automatically encrypted using AWS KMS keys. This ensures that the data stored on the EBS volumes, including the application and any associated files, is encrypted at rest.Additionally, enabling Amazon RDS encryption with AWS KMS keys provides encryption for the RDS database volumes. This encrypts the data stored in the Amazon RDS database, including the personally identifiable information (PII) required by compliance regulations.Both Amazon EBS encryption and Amazon RDS encryption use AWS KMS keys for encryption. AWS KMS provides a highly secure and scalable key management service that integrates seamlessly with other AWS services. By using AWS KMS keys, you can ensure the encryption keys are managed securely and comply with the compliance regulations.Option A suggests using AWS Certificate Manager to generate certificates and encrypt the database volume. However, AWS Certificate Manager is primarily used for managing SSL/TLS certificates for securing network communications rather than encrypting data at rest. It would require additional changes to the infrastructure and may not be the most appropriate solution for encrypting PII at rest.Option B suggests deploying AWS CloudHSM to generate encryption keys and encrypt database volumes. While AWS CloudHSM provides a hardware security module for managing cryptographic keys, it introduces additional complexity and requires changes to the infrastructure. It may not be the least disruptive solution for meeting the encryption requirement.Option C suggests configuring SSL encryption using AWS Key Management Service (AWS KMS) keys to encrypt database volumes. While SSL encryption provides encryption for data in transit, it does not directly address the requirement of encrypting data at rest. It would require additional changes to the infrastructure and may not satisfy the compliance regulations for encrypting PII at rest.In summary, the recommended solution is to configure Amazon EBS encryption and Amazon RDS encryption with AWS KMS keys. This solution allows for encryption at rest for both the EC2 instance and the RDS database volumes with minimal changes to the infrastructure, ensuring compliance with the regulations regarding encryption of personally identifiable information (PII).