Task 5.1: Design and Implement Controls for Data in Transit SCS-C03 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company runs a web application behind an Application Load Balancer (ALB). A security audit requires that all client connections use TLS 1.2 or higher and that weak cipher suites are disabled. The application team must not change the application code. What should the security engineer do?

   • ACreate a new listener on port 443 and attach an AWS WAF rule to block any TLS version below 1.2.
   • BReplace the ALB with a Network Load Balancer (NLB) and enable a TLS listener with a predefined ELBSecurityPolicy-TLS-1-2-2017-01 policy.
   • CConfigure the ALB with a security policy that references a custom policy that only allows TLS 1.2 and TLS 1.3 cipher suites.
   • DEnable TLS termination on the ALB and configure the backend target group to use the same security policy.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of AWS PrivateLink?

   • ATo encrypt data at rest in S3 buckets
   • BTo provide DDoS protection for public-facing applications
   • CTo accelerate content delivery to end users
   • DTo enable private connectivity to AWS services without using the public internet
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which approach is commonly used to encrypt node-to-node communication in an Amazon EKS cluster?

   • AConfiguring security groups to allow all traffic
   • BUsing an internet gateway
   • CEnabling encryption on the EKS control plane
   • DUsing a service mesh like AWS App Mesh
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of AWS Nitro System encryption for data in transit?

   • ATo accelerate network performance
   • BTo encrypt data at rest on EBS volumes
   • CTo provide DDoS protection
   • DTo protect data moving between EC2 instances and other AWS services
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company runs an Amazon EMR cluster that processes sensitive data. The security team requires that data in transit between cluster nodes be encrypted. The cluster also needs to access data in an S3 bucket. The company wants to minimize the performance impact of encryption. What should the security engineer configure?

   • AEnable inter-node encryption in the EMR security configuration and use a VPC endpoint for S3 access.
   • BUse a custom security configuration that enables both inter-node encryption and encryption at rest.
   • CEnable encryption at rest for the EMR cluster and rely on that for in-transit encryption.
   • DDisable inter-node encryption to reduce performance impact and rely on the VPC's network isolation.
   Reveal Solution Discussion Select an answer first