CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Data Encryption Options in AWS
Explore AWS services that encrypt sensitive data at rest and in transit. We analyze a key exam question to enhance your SAA-C03 preparation.
A common challenge in the AWS Certified Solutions Architect - Associate (SAA-C03) exam is understanding the specifics of data encryption across various services. Candidates often hesitate when distinguishing which AWS services can meet strict security requirements for sensitive data. This question is a prime example of that challenge.
The question
A company has a requirement to store sensitive data and wants to ensure it is encrypted at rest and in transit. Which AWS services can help them meet these security requirements?
A. Amazon S3 with server-side encryption and HTTPS
B. Amazon RDS with encryption enabled and VPC peering
C. Amazon DynamoDB with encryption at rest and SSL connections
D. All of the above
Think before you scroll
Before revealing the answer, weigh the encryption capabilities of each service mentioned. Are they comprehensive enough to meet both encryption at rest and in transit requirements? Understanding the features of AWS services is crucial.
The answer
The correct option is D. All of the above. Each service listed offers mechanisms that support encryption at rest and in transit, ensuring compliance with security requirements.
Why the other options lose
A. Amazon S3 with server-side encryption and HTTPS: While S3 does provide server-side encryption and HTTPS for secure data transfer, it alone does not cover all possible scenarios for sensitive data storage as well as the other options combined.
B. Amazon RDS with encryption enabled and VPC peering: Amazon RDS does support encryption at rest when enabled. However, VPC peering itself does not guarantee that data in transit is encrypted unless additional configurations are made. Therefore, this option is incomplete.
C. Amazon DynamoDB with encryption at rest and SSL connections: DynamoDB provides encryption at rest and can use SSL for secure connections. However, it is not the only solution available. While it is a valid option, it does not encompass the full range of services capable of meeting the requirements.
The concept behind it
The principle here is understanding that multiple AWS services offer overlapping encryption features. When tasked with securing sensitive data, it’s vital to recognize that options like Amazon S3, RDS, and DynamoDB each contribute to a secure architecture. They can be combined to meet both encryption at rest and in transit requirements.
Exam trap to remember
Remember: when faced with multiple valid options in the AWS exam, consider whether each option meets all parts of the question. In this case, all services offered encryption at both states, making D the best choice.