Q85 — AWS SAA-C03 Ch.17

Question 85 of 89 | ← Chapter 17

Q1385. A company has multiple applications that run on Amazon EC2 instances in a single VPC. The applications need to encrypt and decrypt a specific data item in the records exchanged between the applications.Which solution will meet this requirement?

Correct Answer: C. Use an AWS KMS customer-managed symmetric key.

Explanation

Let's analyze each option to determine the best solution for encrypting and decrypting a specific data item in the records exchanged between applications running on Amazon EC2 instances in a single VPC:Option A: Encrypt the Amazon EBS storage that is associated with each application EC2 instance Encrypting Amazon EBS storage is useful for protecting the data stored on the disks attached to the EC2 instances. However, the requirement in this scenario is to encrypt and decrypt a specific data item in the records exchanged between the applications, not the data stored on the EBS volumes. So, this option does not meet the requirement.Option B: Use an AWS KMS AWS owned symmetric keyAWS - owned symmetric keys are managed by AWS and are used by AWS services for their internal operations. These keys are not intended for customer - specific data encryption and decryption in the context described in the question. Customers do not have direct control over these keys for encrypting their application - level data. Therefore, this option is not suitable.Option C: Use an AWS KMS customer - managed symmetric keyAWS Key Management Service (KMS) allows customers to create and manage their own encryption keys. A customer - managed symmetric key provides the following advantages for this scenario:Granular control: The company has full control over the key, including its creation, rotation, and access policies.Application - level encryption: The applications can use the customer - managed symmetric key to encrypt and decrypt the specific data item in the records exchanged between them. This meets the requirement of securing the data in transit between the applications.Integration with AWS services: AWS KMS integrates well with other AWS services, making it easy to use the key for encryption and decryption operations within the EC2 - based applications. Option D: Use a virtual private gateway to encrypt traffic between the applications A virtual private gateway is mainly used for establishing a VPN connection between an on - premises network and an Amazon VPC. It is designed to encrypt the traffic between the on - premises network and the VPC, not for encrypting specific data items within the records exchanged between applications running inside the same VPC. So, this option does not address the requirement. Based on the above analysis, the solution that will meet the requirement of encrypting and decrypting a specific data item in the records exchanged between the applications is to use an AWS KMS customer - managed symmetric key.So the answer is C.