CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Decoding AWS SAA-C03: Multi-tier Application Security
Understand how to secure sensitive user data in AWS. Explore the right services for encryption in transit and at rest.
Designing a multi-tier application often trips candidates up, especially when it comes to data security. Encryption is a critical requirement, and knowing which AWS services to choose can make all the difference.
The question
A company is designing a multi-tier application that processes sensitive user data. They want to ensure that data is encrypted in transit and at rest. Which combination of AWS services should they use to meet these security requirements?
A. Amazon S3 with Server-Side Encryption and AWS Shield
B. Amazon RDS with SSL connections and AWS KMS for encryption
C. Amazon EC2 with security groups and IAM roles
D. Amazon CloudFront with signed URLs and AWS WAF
Think before you scroll
Before making a choice, consider how each option addresses encryption in both transit and at rest. Look for services that specifically mention SSL for transit encryption and KMS for encryption at rest. The question emphasizes both requirements, so focus on that aspect.
The answer
The correct option is B. Amazon RDS with SSL connections and AWS KMS for encryption. Amazon RDS supports SSL connections to encrypt data in transit. It also uses AWS KMS to encrypt data at rest, making it the best choice for the company’s needs.
Why the other options lose
A. Amazon S3 with Server-Side Encryption and AWS Shield: While Amazon S3 does support server-side encryption for data at rest, it does not specifically address encryption in transit. AWS Shield is primarily for DDoS protection, not for data encryption.
C. Amazon EC2 with security groups and IAM roles: Security groups and IAM roles are essential for access control but do not provide encryption in transit or at rest. This option fails to meet the encryption requirements.
D. Amazon CloudFront with signed URLs and AWS WAF: CloudFront can secure content delivery, but signed URLs do not encrypt data in transit. AWS WAF protects web applications but does not address encryption requirements directly, making this option insufficient.
The concept behind it
When designing secure architectures in AWS, it’s crucial to ensure data is encrypted both in transit and at rest. Look for services that explicitly mention these capabilities. SSL connections are vital for protecting data as it travels over the network, while AWS KMS provides encryption for data stored in services like RDS.
Exam trap to remember
Remember, always check for both encryption in transit and at rest when evaluating AWS services for sensitive data. If an option lacks one of these, it's likely not the correct answer.