Q62 — AWS SAA-C03 Ch.13

Question 62 of 100 | ← Chapter 13

Q962. A financial services company plans to launch a new application on AWS to handle sensitive financial transactions.The company will deploy the application on Amazon EC2 instances.The company will use Amazon RDS for MySQL as the database.The company's security policies mandate that data must be encrypted at rest and in transit.Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: A. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure AWS Certificate Manager (ACM) SSL/TLS certificates for encryption in transit.

Explanation

The solution that meets the requirements with the LEAST operational overhead is A. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure AWS Certificate Manager (ACM) SSL/TLS certificates for encryption in transit.Here's why:Encryption at Rest: Amazon RDS for MySQL offers built-in encryption at rest using AWS KMS managed keys. This is the simplest and most efficient way to encrypt data stored in the database. Encryption in Transit: ACM SSL/TLS certificates are readily available and easy to configure for encrypting data in transit between the EC2 instances and the RDS database. This eliminates the need for complex VPN or IPsec configurations.Minimal Operational Overhead: Using KMS managed keys and ACM certificates requires minimal configuration and ongoing management. AWS handles the key management and certificate lifecycle, reducing operational burden.Why other options are less efficient:B. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure IPsec tunnels for encryption in transit: Setting up and managing IPsec tunnels adds significant operational overhead, requiring configuration and maintenance of VPN gateways and network policies. C. Implement third-party application-level data encryption before storing data in Amazon RDS for MySQL. Configure AWS Certificate Manager (ACM) SSL/TLS certificates for encryption in transit: Implementing application-level encryption introduces complexity and potential performance overhead. It also requires managing and maintaining the encryption library within the application. D. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure a VPN connection to enable private connectivity to encrypt data in transit: Similar to IPsec tunnels, setting up and managing a VPN connection adds operational overhead and requires ongoing maintenance.In summary:Option A provides the most streamlined and efficient solution for meeting the company's security requirements. By leveraging the built-in encryption features of RDS and ACM, the company can achieve strong security posture with minimal operational overhead.