SAA-C03 Q220 · Security

Question

A solutions architect is creating a new Amazon CloudFront distribution for an application. Some of the information submitted by users is sensitive. The application uses HTTPS but needs another layer of security. The sensitive information should.be protected throughout the entire application stack, and access to the information should be restricted to certain applications. Which action should the solutions architect take?

Accepted Answer

**C. Configure a CloudFront field-level encryption profile.**

Let's map each requirement to the solution:

1. **'Another layer of security' beyond HTTPS**: Field-level encryption adds encryption on top of the existing HTTPS connection. At the CloudFront edge, specific form fields are encrypted using a public key before being forwarded to the origin. This means even if HTTPS is terminated at the load balancer, the sensitive fields remain encrypted.

2. **'Protected throughout the entire application stack'**: With field-level encryption, sensitive data is encrypted at the edge and stays encrypted as it travels through the origin servers, load balancers, and any intermediate services. Only the final application component that holds the corresponding private key can decrypt it. This provides

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips