SAA-C03 Q96 · Security

Question

A company uses Amazon EC2 instances behind an Application Load Balancer (ALB) to serve content to users. The company uses Amazon Elastic Block Store (Amazon EBS) volumes to store data. The company needs to encrypt data in transit and at rest. Which combination of services will meet these requirements? (Select TWO)

Accepted Answer

The question has two distinct requirements:

**Requirement 1: Encrypt data in transit**
- Data in transit means data flowing between the user's browser and the ALB, and between the ALB and EC2 instances.
- **AWS Certificate Manager (ACM)** provisions, manages, and deploys **TLS/SSL certificates** for use with AWS services like ALB.
- You attach an ACM certificate to the ALB's HTTPS listener, enabling TLS encryption for all traffic between clients and the load balancer.
- This satisfies encryption in transit.

**Requirement 2: Encrypt data at rest**
- Data at rest is stored on **Amazon EBS volumes**.
- **AWS Key Management Service (KMS)** creates and manages encryption keys used to encrypt EBS volumes.
- When you enable EBS encryption, AWS uses a KMS key (either AWS-managed or customer-mana

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips