DBS-C01 · Question #52
A financial services company is developing a shared data service that supports different applications from throughout the company. A Database Specialist designed a solution to leverage Amazon…
The correct answer is A. Enable in-transit and at-rest encryption on the ElastiCache cluster. C. Ensure the security group for the ElastiCache cluster allows all inbound traffic from itself and F. Ensure the cluster is created with the auth-token parameter and that the parameter is used in all. Securing Amazon ElastiCache for Redis Enabling in-transit and at-rest encryption (A) protects data as it moves between clients and the cluster and while stored on disk, addressing two critical attack surfaces. Configuring the security group to allow inbound traffic from itself…
Question
A financial services company is developing a shared data service that supports different applications from throughout the company. A Database Specialist designed a solution to leverage Amazon ElastiCache for Redis with cluster mode enabled to enhance performance and scalability. The cluster is configured to listen on port 6379. Which combination of steps should the Database Specialist take to secure the cache data and protect it from unauthorized access? (Choose three.)
Options
- AEnable in-transit and at-rest encryption on the ElastiCache cluster.
- BEnsure that Amazon CloudWatch metrics are configured in the ElastiCache cluster.
- CEnsure the security group for the ElastiCache cluster allows all inbound traffic from itself and
- DCreate an IAM policy to allow the application service roles to access all ElastiCache API actions.
- EEnsure the security group for the ElastiCache clients authorize inbound TCP port 6379 and port
- FEnsure the cluster is created with the auth-token parameter and that the parameter is used in all
How the community answered
(14 responses)- A79% (11)
- D14% (2)
- E7% (1)
Explanation
Securing Amazon ElastiCache for Redis
Enabling in-transit and at-rest encryption (A) protects data as it moves between clients and the cluster and while stored on disk, addressing two critical attack surfaces. Configuring the security group to allow inbound traffic from itself and trusted clients (C) ensures only authorized resources within the VPC can reach the cluster on port 6379, enforcing network-level access control. Using the auth-token parameter (F) requires clients to authenticate with a password before accessing Redis, adding an application-level authentication layer on top of network controls - together, these three form a complete defense-in-depth strategy.
Why the distractors are wrong:
- B (CloudWatch metrics): Monitoring improves visibility but does nothing to prevent unauthorized access - it's an observability tool, not a security control.
- D (IAM policy for all ElastiCache API actions): Granting all API actions is overly permissive and violates least-privilege principles; IAM also controls the management plane, not data-plane Redis access.
- E (Client security group with port 6379): Inbound rules on the client's security group don't protect the ElastiCache cluster itself; the control belongs on the cluster's security group.
Memory Tip
Think "ENA" - Encrypt (in-transit + at-rest), Network controls (security groups on the cluster), Auth-token - the three pillars of ElastiCache security.
Topics
Community Discussion
No community discussion yet for this question.