Exams / SCS-C03 / Study guide / Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM)
Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM): SCS-C03 study notes and practice questions
What to know about Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM) for the SCS-C03 exam, from the Data Protection domain (18% of the exam guide), then 2 free questions to test it. Part of the SCS-C03 study guide.
These questions describe a rule such as “all data must be encrypted in transit” or “reject any plaintext connection,” then ask which control enforces it at the resource and which log shows it happened.
Enforcement points
Resource policies: a Deny statement with the condition aws:SecureTransport set to false rejects any request sent over plain HTTP. This is the standard answer for “force HTTPS to this bucket.” Put the same Deny in an SCP or RCP when the rule covers the whole organization.
Load balancers: choose a TLS security policy on the listener that turns off old protocol versions and weak ciphers. Redirect HTTP to HTTPS with a listener rule or remove the HTTP listener. Application Load Balancers can also require client certificates (mutual TLS).
CloudFront: set the viewer protocol policy to redirect HTTP to HTTPS or to HTTPS only. Set the origin protocol policy to HTTPS only so traffic stays encrypted from the edge to the origin.
Databases: turn on the engine’s SSL requirement through the parameter group, then have clients verify the server certificate against the AWS CA bundle. A setting that only the client can choose does not enforce anything.
Certificates: AWS Certificate Manager issues public certificates and renews them automatically for integrated services. Private CA issues certificates for internal names that public CAs should not sign.
How to choose
Scenario wording
Pick
Reject plaintext requests to one bucket
Bucket policy Deny with aws:SecureTransport = false
Enforce the same rule across every bucket in the organization
RCP or SCP with the same Deny
Block old TLS versions on a public web endpoint
Load balancer or CloudFront TLS security policy
Force encryption on a database connection
Parameter group SSL setting, plus client certificate checks
Internal service certificates that public CAs must not issue
Private CA
Show the TLS version and cipher used for each API call
CloudTrail tlsDetails field
Common traps
A Deny written with the wrong operator. The check is a boolean false. A Deny that tests the wrong key or value does nothing, and the exam often offers it as a near miss.
Trusting a security group to block plaintext. Security groups filter by port and source, not by protocol.
Assuming any ACM certificate can be installed anywhere. Certificates that ACM deploys to integrated services, such as load balancers and CloudFront, keep their private key in ACM. Check the export options before choosing ACM for a server you manage yourself; certificates signed by AWS Private CA can be exported for internal use.
Leaving an HTTP listener open next to an HTTPS listener. Redirect it or remove it.
Using a public certificate for internal names when the scenario says the names are private.
A payments processor exposes a public card-authorization API through an Application Load Balancer. Its PCI assessor requires that connections use TLS 1.2 or later, that older protocols such as TLS 1.0 and 1.1 are refused, and that every cipher suite provides forward secrecy.
Partner clients on modern stacks should negotiate TLS 1.3 when they support it. The certificate comes from AWS Certificate Manager, and the team wants to keep one HTTPS listener with no change to the application.
Which solution meets these requirements?
Choose one answer.
AA. Keep the default listener security policy, and add an AWS WAF rule that matches the JA3 fingerprint of clients that offer TLS 1.0 or 1.1. Leave the HTTPS listener and its certificate unchanged.
BB. Attach the predefined policy ELBSecurityPolicy-FS-1-2-Res-2020-10 to the HTTPS listener, which supports only TLS 1.2 with forward secrecy. Leave the certificate and application unchanged, since TLS 1.3 clients can still use TLS 1.2.
CC. Attach the predefined policy ELBSecurityPolicy-TLS13-1-0-2021-06 to the listener, which allows TLS 1.0 for older partners. Ask partners to move to TLS 1.2 within six months, and review the negotiated protocol in the access logs each month.
DD. Attach the predefined policy ELBSecurityPolicy-TLS13-1-2-2021-06 to the existing HTTPS listener. It supports only TLS 1.2 and TLS 1.3 with forward secrecy, and the ACM certificate stays on the listener unchanged.
Show the answer and explanation
Answer: D
A. Wrong: Fingerprint matching is a blocklist that a client can change, and it does not stop the listener from accepting TLS 1.0 handshakes. The default policy still allows older protocols, so the assessor requirement is not met by a WAF rule.
B. Wrong: The policy refuses older protocols and keeps forward secrecy, but it does not offer TLS 1.3. Partners that support TLS 1.3 would be held to TLS 1.2, which misses the stated requirement.
C. Wrong: This policy keeps accepting TLS 1.0 until every partner moves, which the assessor forbids. Reviewing access logs each month finds problems after they happen, rather than preventing them.
A listener security policy sets which protocols and cipher suites the load balancer accepts. The predefined TLS 1.3 policy that includes TLS 1.2 refuses older protocols, keeps forward secrecy, and lets modern clients use TLS 1.3. The other options accept older protocols, drop TLS 1.3, or rely on a fingerprint blocklist.
A health insurer runs a claims API on EC2 instances behind a Network Load Balancer. Partner hospitals send claims over TLS, and the insurer's policy says that TLS must end on the insurer's own application instances, so that no load balancer or other intermediary can read the plaintext.
The partners also present client certificates, which the application must check itself. The design must support the current fleet and keep the load balancer health checks working.
Which solution meets these requirements?
Choose one answer.
AA. Create a TLS listener on the Network Load Balancer with an ACM certificate, and forward traffic to the instances over HTTP on port 80. The load balancer terminates TLS, and the instances process claims without certificates.
BB. Create a Network Load Balancer with a TCP listener on port 443, and forward the connections unchanged to the instances. Each instance terminates TLS with its own certificate, and the application checks partner client certificates.
CC. Create an Application Load Balancer with an HTTPS listener and an ACM certificate, and forward traffic to the instances over HTTP. Turn on client certificate verification on the listener, so the load balancer checks partner certificates.
DD. Create an Application Load Balancer with an HTTPS listener, and re-encrypt traffic to the instances over HTTPS with their own certificates. The instances then check partner client certificates themselves.
Show the answer and explanation
Answer: B
A. Wrong: The load balancer decrypts the traffic, so it can read plaintext, which the policy forbids. Plain HTTP between the load balancer and the instances also leaves claims unencrypted on the internal network.
B. Right: Correct. A TCP listener passes the encrypted stream through without decrypting it, so only the instance reads the claims. The instance TLS stack checks partner client certificates, and the load balancer health checks still work over TCP. Learn more: Listeners for your Network Load Balancer (opens in a new tab)
C. Wrong: The Application Load Balancer decrypts each request to read it and route it, which breaks the no-intermediary rule. The instances would also receive plaintext over HTTP.
D. Wrong: Re-encryption protects the second hop, but the load balancer still decrypts each request before it sends it on. The policy says no intermediary may read plaintext, so this design fails it.
Explanation
A TCP listener on a Network Load Balancer forwards encrypted traffic without terminating TLS, so the instance is the only endpoint that reads claims. The application then handles client certificate checks itself. Listeners that terminate TLS, including Application Load Balancer re-encryption, let an intermediary read the plaintext.
Want more on Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM)? The 5 full-length practice sets have 5 more Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Requiring encryption in transit (TLS policies, aws:SecureTransport, ACM)