SAA-C03 Q638 · Security

Question

A company is running a highly sensitive application on Amazon EC2 backed by an Amazon RDS database. Compliance regulations mandate that all personally identifiable information (PII) be encrypted at rest. Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure?

Accepted Answer

**Option D is correct because it addresses ALL components that store PII with the LEAST infrastructure changes:**

1. **Requirement: Encrypt ALL PII at rest** — PII exists in two places: EC2 instance volumes (EBS) and the RDS database storage.

2. **Amazon EBS Encryption** — EC2 instances use EBS volumes for storage. Enabling EBS encryption with AWS KMS keys encrypts data at rest on these volumes transparently. This is a native AWS feature requiring no application code changes.

3. **Amazon RDS Encryption** — RDS natively supports encryption at rest using AWS KMS keys. When enabled, it encrypts the underlying storage, automated backups, read replicas, and snapshots. Again, this is a checkbox-level configuration — no application changes needed.

4. **AWS KMS as the key management service**

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips