Q74 — AWS SAA-C03 Ch.14

Question 74 of 100 | ← Chapter 14

Q1074. A company has a web application that retrieves customer financial information. The application runs on Amazon EC2 instances. The application uses an Amazon RDS for PostgreSQL database to store confidential information.The company needs to encrypt network traffic between the application and the database.Which combinations of solutions will meet this requirement?(Select TWO).

Correct Answer: A. Configure the RDS for PostgreSQL instances to encrypt traffic by using an option group., E. Do not restart the RDS for PostgreSQL instances after the configuration update.

Explanation

To encrypt network traffic between the web application running on Amazon EC2 instances and the Amazon RDS for PostgreSQL database, the correct combinations of solutions are:A. Configure the RDS for PostgreSQL instances to encrypt traffic by using an option group.AndE. Do not restart the RDS for PostgreSQL instances after the configuration update.Here's why:Option Group for Encryption:Amazon RDS provides the ability to encrypt traffic between the RDS instances and clients. To enable SSL/TLS for PostgreSQL, you need to modify the RDS option group for the database instance. This involves setting the rds.ssl_mode parameter to require in the option group.No Need to Restart RDS Instances:Once the option group is configured correctly, the changes take effect immediately for new connections. Existing connections will continue to use the old configuration until they are closed and re-established. Therefore, there is no need to restart the RDS instances after updating the option group configuration.Now, let's evaluate the other options:B. Configure the RDS for PostgreSQL instances to encrypt traffic by using a parameter group. Parameter groups are used to manage database engine parameters, but they do not directly control SSL/ TLS encryption for client connections. Encryption settings for client connections are configured through option groups.C. Terminate the existing RDS for PostgreSQL instances. Recreate the instances with the necessary security configuration.Terminating and recreating RDS instances is a drastic measure that should be avoided unless absolutely necessary. It would result in data loss (unless backups are restored) and downtime. Instead, it's better to modify the existing instance's configuration.D. Restart the RDS for PostgreSQL instances after the configuration update. As mentioned, there is no need to restart RDS instances after updating the option group configuration for SSL/TLS encryption. The changes will take effect for new connections without requiring a restart. Therefore, the correct combinations of solutions to meet the requirement of encrypting network traffic between the application and the database are:A. Configure the RDS for PostgreSQL instances to encrypt traffic by using an option group.E. Do not restart the RDS for PostgreSQL instances after the configuration update.