AWS Certified Database – Specialty — Question 106

A company uses Amazon Aurora for secure financial transactions. The data must always be encrypted at rest and in transit to meet compliance requirements.
Which combination of actions should a database specialist take to meet these requirements? (Choose two.)

Answer options

• A. Create an Aurora Replica with encryption enabled using AWS Key Management Service (AWS KMS). Then promote the replica to master.
• B. Use SSL/TLS to secure the in-transit connection between the financial application and the Aurora DB cluster.
• C. Modify the existing Aurora DB cluster and enable encryption using an AWS Key Management Service (AWS KMS) encryption key. Apply the changes immediately.
• D. Take a snapshot of the Aurora DB cluster and encrypt the snapshot using an AWS Key Management Service (AWS KMS) encryption key. Restore the snapshot to a new DB cluster and update the financial application database endpoints.
• E. Use AWS Key Management Service (AWS KMS) to secure the in-transit connection between the financial application and the Aurora DB cluster.

Correct answer: B, D

Explanation

Option B is correct as it directly secures the in-transit data using SSL/TLS, which is essential for protecting sensitive data during transmission. Option D is also correct because it involves encrypting the snapshot, ensuring data at rest is protected. The other options either focus on modifying the DB cluster without guaranteeing encryption at both states or incorrectly suggest securing in-transit connections using only AWS KMS, which does not provide the necessary encryption level.