CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Exam Question Walkthrough: Secure Architecture for Sensitive Data
Learn to tackle AWS Certified Solutions Architect - Associate exam questions on secure architectures effectively.
A common pitfall for candidates is understanding the right combination of AWS services to ensure data security. This question focuses on encrypting sensitive customer data both at rest and in transit.
The question
A company is designing a secure architecture for its web application that processes sensitive customer data. They want to ensure that the data is encrypted at rest and in transit. Which combination of AWS services should they implement to achieve this?
A. AWS Shield and AWS WAF
B. Amazon S3 with server-side encryption and AWS Certificate Manager
C. Amazon CloudFront and AWS Direct Connect
D. Amazon RDS with encryption and AWS Inspector
Think before you scroll
Before choosing an answer, consider which services specifically address both encryption at rest and encryption in transit. Look for options that directly support these security requirements.
The answer
The correct option is B. Amazon S3 with server-side encryption and AWS Certificate Manager. Amazon S3 with server-side encryption secures data at rest, while AWS Certificate Manager provides SSL/TLS certificates to encrypt data in transit.
Why the other options lose
- A. AWS Shield and AWS WAF: These services are primarily focused on protecting web applications from DDoS attacks and web exploits. They do not provide encryption capabilities for data at rest or in transit.
- C. Amazon CloudFront and AWS Direct Connect: While CloudFront can help with content delivery and can use HTTPS for encryption in transit, it does not address encryption for data at rest. AWS Direct Connect is a network service that provides a dedicated connection but does not encrypt data by itself.
- D. Amazon RDS with encryption and AWS Inspector: Amazon RDS can encrypt data at rest, but AWS Inspector is a security assessment service that does not provide encryption capabilities. This option fails to cover the need for encryption in transit.
The concept behind it
To design secure architectures in AWS, always ensure that sensitive data is encrypted both at rest and in transit. This often involves combining storage services like S3 with security services that manage certificates and encryption protocols.
Exam trap to remember
Remember: the two-question rule. Always identify both requirements in a question—like encryption at rest and in transit—before selecting your answer.