CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate (SAA-C03) Exam Question Walkthrough: Encryption Requirements
Learn how to approach AWS exam questions about encryption requirements, focusing on compliance and sensitive data protection.
A common pitfall in the AWS Certified Solutions Architect - Associate exam involves understanding the different encryption options available. Candidates often confuse the various services and their capabilities for securing sensitive data. This question tests your knowledge of encryption strategies in the cloud.
The question
A financial services company is migrating their on-premises application to AWS. They need to ensure that sensitive data is encrypted in transit and at rest, while also meeting compliance requirements. What should they implement?
A. AWS Shield and AWS WAF
B. Amazon S3 Server-Side Encryption and AWS Certificate Manager
C. Amazon RDS encryption and VPC Peering
D. AWS IAM roles and Security Groups
Think before you scroll
Before choosing your answer, consider the requirements: encryption in transit and at rest, along with compliance needs. Focus on options that specifically address both aspects of encryption.
The answer
The correct option is B: Amazon S3 Server-Side Encryption and AWS Certificate Manager. This combination meets both encryption requirements. S3 Server-Side Encryption secures data at rest, while AWS Certificate Manager provides SSL/TLS certificates for encrypting data in transit, fulfilling compliance mandates.
Why the other options lose
A. AWS Shield and AWS WAF: This choice focuses on protection against DDoS attacks and web application security, respectively. Neither service addresses the encryption requirements specified in the question.
C. Amazon RDS encryption and VPC Peering: While Amazon RDS encryption does secure data at rest, VPC Peering does not relate to encrypting data in transit. This option only partially meets the requirement.
D. AWS IAM roles and Security Groups: This option deals with access control and network security. IAM roles help manage permissions, while Security Groups control inbound and outbound traffic. Neither provides a solution for encrypting data in transit or at rest.
The concept behind it
Understanding encryption in AWS is crucial. Data should be encrypted both at rest and in transit to ensure compliance and protect sensitive information. Services like Amazon S3 and AWS Certificate Manager are designed specifically for these purposes. Always assess whether a solution addresses both encryption needs.
Exam trap to remember
Always check for both encryption requirements in questions. If an option only covers one aspect, it likely won't be the right choice.