nerdexam
Amazon

SCS-C02 · Question #50

A company is developing an ecommerce application. The application uses Amazon EC2 instances and an Amazon RDS MySQL database. For compliance reasons, data must be secured in transit and at rest. The c

The correct answer is A. Use TLS certificates from AWS Certificate Manager (ACM) with an Application Load Balancer.. ACM TLS certificates on an Application Load Balancer secure data in transit, while enabling RDS encryption secures data at rest, both with minimal operational overhead.

Submitted by tarun92· Mar 6, 2026Data Protection

Question

A company is developing an ecommerce application. The application uses Amazon EC2 instances and an Amazon RDS MySQL database. For compliance reasons, data must be secured in transit and at rest. The company needs a solution that minimizes operational overhead and minimizes cost. Which solution meets these requirements?

Options

  • AUse TLS certificates from AWS Certificate Manager (ACM) with an Application Load Balancer.
  • BUse TLS certificates from a third-party vendor with an Application Load Balancer. Install the same
  • CUse AWS CloudHSM to generate TLS certificates for the EC2 instances. Install the TLS
  • DUse Amazon CloudFront with AWS WAF. Send HTTP connections to the origin EC2 instances.

How the community answered

(42 responses)
  • A
    83% (35)
  • B
    10% (4)
  • C
    2% (1)
  • D
    5% (2)

Why each option

ACM TLS certificates on an Application Load Balancer secure data in transit, while enabling RDS encryption secures data at rest, both with minimal operational overhead.

AUse TLS certificates from AWS Certificate Manager (ACM) with an Application Load Balancer.Correct

ACM provides free, auto-renewing TLS certificates that integrate natively with Application Load Balancers, securing HTTP traffic in transit between clients and the application with zero certificate management overhead. Amazon RDS supports encryption at rest using AWS KMS, which can be enabled at creation time without additional infrastructure, satisfying both compliance requirements at the lowest operational cost.

BUse TLS certificates from a third-party vendor with an Application Load Balancer. Install the same

Using third-party TLS certificates requires manual procurement, installation, and renewal across all EC2 instances, which significantly increases operational overhead compared to ACM-managed certificates.

CUse AWS CloudHSM to generate TLS certificates for the EC2 instances. Install the TLS

AWS CloudHSM provides dedicated hardware security modules for strict compliance requirements but carries substantial cost (approximately $1.60/hour per HSM) and operational complexity far exceeding what is necessary for standard TLS termination.

DUse Amazon CloudFront with AWS WAF. Send HTTP connections to the origin EC2 instances.

Sending HTTP (unencrypted) connections from CloudFront to the origin EC2 instances fails to secure data in transit between the CDN and the application tier, violating the requirement that data must be secured in transit end-to-end.

Concept tested: Encryption in transit with ACM and ALB, RDS encryption at rest

Source: https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html

Topics

#TLS certificates#ACM#data in transit encryption#RDS encryption

Community Discussion

No community discussion yet for this question.

Full SCS-C02 Practice