Examkin

Question

Difficulty: MediumData Protection and Encryption

An e-learning platform hosts its student database on Amazon RDS. The platform's security policy requires all data to be encrypted in transit between the application servers and the database instance. Under the AWS Shared Responsibility Model, which of the following is a customer responsibility for securing this data in transit?

  1. A
    Deploying dedicated AWS CloudHSM instances to manage SSL/TLS certificates for the database connection.
  2. B
    Managing the physical network switches that route traffic between the application and database instances.
  3. Enabling and enforcing SSL/TLS connections on the application client side when connecting to the database.Answer
  4. D
    Provisioning physical network isolation at the virtualization layer of the AWS infrastructure.

Answer

Enabling and enforcing SSL/TLS connections on the application client side when connecting to the database.
The correct answer is correct because configuration of database client applications, such as forcing SSL/TLS connections, is an application-level setting controlled and managed by the customer. AWS manages the underlying RDS infrastructure, but the customer must instruct their applications to connect securely.

Step-by-Step Solution

1
Analyze the security requirement and model boundaries
The requirement is to secure data in transit (encryption in transit) between the application tier and the database tier in AWS.
This establishes what is being protected and where the boundaries of control lie.
2
Distinguish between customer and AWS responsibilities under the Shared Responsibility Model
AWS is responsible for 'Security of the Cloud' (physical infrastructure, virtualization layer, hardware). The customer is responsible for 'Security in the Cloud' (operating system configuration, firewall rules, and application-level settings such as client-side connection parameters).
Enforcing secure client connections belongs to application configuration, which falls under customer responsibility.

Key Concept

Under the AWS Shared Responsibility Model, AWS manages host-level and network infrastructure security (including providing TLS/SSL capability for managed services), while customers are responsible for configuring application clients, enabling secure transmission protocols, and managing connection settings.
Estimated Time:1m 15s
Rate this question

Topics

Data Protection and Encryption

More questions from this topic