CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Encryption for Sensitive Data in AWS
Explore an exam question on data encryption in AWS. Learn how to choose the right services for encryption at rest and in transit.
A common stumbling block for candidates is ensuring both data at rest and in transit are adequately protected. This question tests your understanding of AWS services that provide encryption features. Let's break it down.
The question
A company is developing a new web application that will store sensitive user data. They need to ensure that data is encrypted both at rest and in transit. Which combination of AWS services and features should they use to meet these requirements?
- A. Use Amazon RDS with encryption enabled and AWS Certificate Manager for SSL certificates.
- B. Use Amazon S3 with default encryption enabled and AWS WAF for web application firewall.
- C. Use Amazon EC2 with EBS volumes encrypted and implement VPN for data in transit.
- D. Use AWS Lambda with encrypted environment variables and CloudFront for HTTPS.
Think before you scroll
When faced with this question, consider which options address both encryption at rest and in transit. Focus on the services that specifically mention encryption capabilities for both scenarios.
The answer
The correct options are A and C. Both options provide solutions for encrypting data at rest and in transit using appropriate AWS services. Option A uses Amazon RDS with encryption and AWS Certificate Manager for SSL, while Option C employs Amazon EC2 with encrypted EBS volumes and a VPN for secure transmission.
Why the other options lose
- Option B: This option suggests using Amazon S3 with default encryption enabled. While it covers encryption at rest, it does not address encryption in transit effectively. The addition of AWS WAF also does not contribute to ensuring data is encrypted during transfer.
- Option D: This option involves AWS Lambda with encrypted environment variables. However, it only addresses encryption at rest. While CloudFront can provide HTTPS for secure transmission, this combination lacks a solid mechanism for encrypting data at rest, making it insufficient for meeting both requirements.
The concept behind it
To secure sensitive data, you must employ strategies for both encryption at rest and in transit. AWS offers various services like Amazon RDS, EC2, and others that can be configured to ensure data is protected in both scenarios. Always evaluate the specific features of each service to ensure comprehensive protection.
Exam trap to remember
Remember the two-question rule: always confirm if both aspects of encryption are covered. If an option only addresses one without the other, it likely won't be the right choice.