SCS-C02 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable encryption at rest for the RDS instance using AWS KMS.

  Why it's wrong here

  Encryption at rest via AWS KMS protects the RDS data files, snapshots, and automated backups on disk, but it does nothing for traffic on the wire. Data in transit between your EC2 instance and the database travels over the network as plaintext unless an encryption protocol such as TLS/SSL is explicitly used. KMS-managed keys for RDS encryption are unrelated to securing client-to-database connections.

• ✗

  Set up a VPN connection between the EC2 instances and the RDS database.

  Why it's wrong here

  An AWS Site-to-Site VPN is designed to connect an on-premises network to a VPC, not to encrypt traffic between two resources that already reside in the same VPC. EC2 instances and an RDS database communicate directly over the VPC's private network; introducing a VPN tunnel between them is incorrect and would not be supported as a standard RDS connection path. The proper way to encrypt this in-VPC traffic is to enable SSL/TLS on the database and in the client connection.

• ✗

  Configure the security group for the RDS instance to enforce encryption.

  Why it's wrong here

  A security group acts as a stateful firewall that filters allowed traffic based on source IP, port, and protocol; it has no awareness of application-layer payloads and cannot force a database engine to encrypt its traffic. Even if the security group restricts access to the RDS port, connections that are permitted may still be transmitted in plaintext. Encryption enforcement must happen at the database layer, for example by requiring SSL/TLS via RDS parameter settings or connection string options.

• ✓

  Enable SSL/TLS on the RDS instance and configure the EC2 instances to connect using SSL.

  Why this is correct

  Enabling SSL/TLS on the RDS instance makes the database server accept and require encrypted connections, and configuring the EC2 clients to connect with SSL (for example, using sslmode=require or verify-full in PostgreSQL, or useSSL=true in MySQL) encrypts all data in flight between the application and the database. RDS provides server certificates for each region that clients can validate to prevent man-in-the-middle attacks. This directly satisfies the requirement that all data in transit be encrypted.

Go deeper

Related to this question