ANS-C01 Defense in depth Practice Question
A company has a requirement to encrypt all data in transit between EC2 instances and an RDS database. The database is in a private subnet, and the application connects using an SSL connection. The security team wants to ensure that even if the network is compromised, the data remains confidential. What additional measure should be taken?
⚠ Common exam trap
Candidates often confuse authentication with encryption. IAM database authentication improves access control but does not add encryption; the question specifically asks for data confidentiality beyond SSL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a client-side encryption library to encrypt data before sending.
Client-side encryption adds an additional layer of security beyond SSL. Even if the network is compromised and SSL is bypassed, the data remains encrypted, ensuring confidentiality. Option D is incorrect: IAM database authentication provides authentication, not encryption; it does not enhance data confidentiality beyond what SSL already offers. Option A is wrong: a VPN between EC2 and RDS adds unnecessary complexity and does not replace or augment SSL encryption. Option C is wrong: encryption at rest protects stored data, not data in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a VPN connection between the EC2 instances and the RDS database.
Why it's wrong here
A VPN between EC2 and RDS adds complexity and does not enhance encryption since SSL is already in use; it is not necessary for this requirement.
- ✓
Use a client-side encryption library to encrypt data before sending.
Why this is correct
Client-side encryption encrypts the data before SSL, providing an additional layer that protects data even if SSL is compromised or bypassed.
- ✗
Enable encryption at rest on the RDS instance.
Why it's wrong here
Encryption at rest protects data stored on disk, not data in transit. The requirement is about data in transit.
- ✗
Use IAM database authentication with SSL.
Why it's wrong here
IAM database authentication is about authentication, not encryption. It does not add confidentiality beyond SSL.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.