A company is running a finance application on an Amazon RDS for MySQL DB instance. The application is governed by multiple financial regulatory agencies. The RDS DB instance is set up with security…

Question

Options

• ASet up NACLs that allow the entire EC2 subnet to access the DB instance
• BDisable the master user account
• CSet up a security group that blocks SSH to the DB instance
• DSet up RDS to use SSL for data in transit

• A
  16% (3)
• B
  5% (1)
• C
  5% (1)
• D
  74% (14)

Explanation

Explanation

Using SSL/TLS with RDS encrypts data in transit between the application (EC2 servers) and the database, which complements the existing KMS encryption at rest - together, these two measures provide end-to-end data protection required by financial regulators. Option A is incorrect and actually reduces security by broadening access to the entire EC2 subnet rather than specific servers. Option B is dangerous because disabling the master user account could lock administrators out of the database entirely. Option C is a distractor because RDS is a managed service - users cannot SSH directly into the underlying DB instance, so blocking SSH provides no meaningful security benefit.

Memory Tip

Think of data protection in two states: data at rest (already covered by KMS) and data in transit (needs SSL). Financial compliance almost always requires both. When a question mentions encryption at rest is already configured, the complementary answer is almost always SSL/TLS for data in transit.

No community discussion yet for this question.