AWS Certified Security – Specialty (SCS-C02) — Question 274

A company is planning to migrate its applications to AWS in a single AWS Region. The company’s applications will use a combination of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, and Amazon S3 buckets. The company wants to complete the migration as quickly as possible. All the applications must meet the following requirements:

• Data must be encrypted at rest.
• Data must be encrypted in transit.
• Endpoints must be monitored for anomalous network traffic.

Which combination of steps should a security engineer take to meet these requirements with the LEAST effort? (Choose three.)

Answer options

• A. Install the Amazon Inspector agent on EC2 instances by using AWS Systems Manager Automation.
• B. Enable Amazon GuardDuty in all AWS accounts.
• C. Create VPC endpoints for Amazon EC2 and Amazon S3. Update VPC route tables to use only the secure VPC endpoints.
• D. Configure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from ACM.
• E. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-meta-side-encryption.
• F. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-server-side-encryption.

Correct answer: B, D, F

Explanation

Amazon GuardDuty (Option B) provides the least-effort solution for monitoring anomalous network traffic by analyzing VPC Flow Logs and DNS logs without requiring agents. To secure data in transit, configuring ACM certificates on the ELB load balancers (Option D) simplifies SSL/TLS termination. For data at rest encryption, utilizing AWS KMS with an S3 bucket policy that checks the 'x-amz-server-side-encryption' header (Option F) ensures all uploaded objects are encrypted, whereas 'x-amz-meta-side-encryption' (Option E) is a non-existent header.