A financial services company plans to launch a new application on AWS to handle sensitive financial transactions. The company will deploy the application on Amazon EC2 instances. The company will…

Question

Options

• AConfigure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys.
• BConfigure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys.
• CImplement third-party application-level data encryption before storing data in Amazon RDS for
• DConfigure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys

• A
  90% (53)
• B
  2% (1)
• C
  2% (1)
• D
  7% (4)

Explanation

This solution provides encryption at rest and in transit with the least operational overhead while adhering to the company's security policies. Encryption at Rest: Amazon RDS for MySQL can be configured to encrypt data at rest by using AWS Key Management Service (KMS) managed keys. This encryption is applied automatically to all data stored on disk, including backups, read replicas, and snapshots. This solution requires minimal operational overhead because AWS manages the encryption and key management process. Encryption in Transit: AWS Certificate Manager (ACM) allows you to provision, manage, and deploy SSL/TLS certificates seamlessly. These certificates can be used to encrypt data in transit by configuring the MySQL instance to use SSL/TLS for connections. This setup ensures thatdata is encrypted between the application and the database, protecting it from interception during transmission. Why Not Other Options? Option B (IPsec tunnels): While IPsec tunnels encrypt data in transit, they are more complex to manage and require additional configuration and maintenance, leading to higher operational Option C (Third-party application-level encryption): Implementing application-level encryption adds complexity, requires code changes, and increases operational overhead. Option D (VPN for encryption): A VPN solution for encrypting data in transit is unnecessary and adds additional complexity without providing any benefit over SSL/TLS, which is simpler to implement and manage.

No community discussion yet for this question.