A health network runs nightly Apache Spark jobs on Amazon EMR over patient claims data. Compliance rules require that data be encrypted in transit between the cluster nodes and encrypted at rest on the storage attached to each node. The team cannot allow unencrypted traffic, even briefly, when a cluster starts.
The clusters are created from an automated template, and the security team wants the settings enforced for every cluster, not set by hand. The team holds its own TLS certificates in a private S3 bucket.
Which solution meets these requirements?
Choose one answer.
AA. Create an EMR security configuration with in-transit encryption using the certificates in the private bucket, and EBS at-rest encryption with a customer managed KMS key. Reference it from the cluster template.
BB. Turn on at-rest encryption only, using the default EBS encryption setting. Add a bootstrap action that installs TLS on each node after the cluster starts, so that in-transit encryption is ready before the first job runs.
CC. Place the cluster in private subnets with a security group that allows traffic only from the team's VPC. The private network path keeps the traffic off the internet, so no extra encryption setting is needed.
DD. Set the cluster to read and write all job data in Amazon S3 with SSE-S3, and rely on S3 encryption to protect traffic between the Spark nodes and the bucket.
Show the answer and explanation
Answer: A
A. Right: Correct. A security configuration applies the in-transit and at-rest settings when the cluster starts, so every cluster built from the template gets them. Referencing the configuration from the template enforces it without manual steps. Learn more: Data encryption in Amazon EMR (opens in a new tab)
B. Wrong: Bootstrap actions run after the cluster starts, so early traffic can be unencrypted, which the team forbids. Default EBS encryption covers the volumes, but it does not encrypt traffic between the nodes.
C. Wrong: Private subnets keep traffic off the internet, but they do not encrypt traffic between the nodes. The compliance rule names encryption in transit, so network placement alone does not meet it.
D. Wrong: SSE-S3 encrypts objects at rest in S3, not the traffic between Spark nodes, and it does not cover the EBS volumes on each node. This option covers only part of the requirement.
Explanation
EMR security configurations set in-transit and at-rest encryption together, and they apply when the cluster starts. Referencing one from the cluster template enforces it for every cluster. Bootstrap timing, network placement, and S3 encryption each cover only part of the compliance rule.
Want more on Encryption between nodes and services (EMR, EKS, SageMaker AI, Nitro)? The 5 full-length practice sets have 6 more Encryption between nodes and services (EMR, EKS, SageMaker AI, Nitro) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →