Study ANS-C01 confidentiality controls for TLS, IPsec, VPN over Direct Connect, MACsec, ACM, ACM PCA, CloudFront, load balancers, S3, Transit Gateway, and DNSSEC.
Confidentiality questions on ANS-C01 are about choosing the right encryption boundary. A strong answer does not just say “encrypt traffic.” It identifies whether encryption belongs at the application layer, transport layer, network layer, link layer, certificate-management layer, or DNS layer.
The current AWS task statement is to implement and maintain confidentiality of data and communications of the network. The official scope includes AWS network encryption options, VPN connectivity over Direct Connect, IPsec, TLS, shared responsibility, DNSSEC, CloudFront, Application Load Balancers, Network Load Balancers, AWS managed databases, Amazon S3, custom EC2 solutions, Transit Gateway, ACM, and AWS Private Certificate Authority.
| Confidentiality decision | What a strong answer checks |
|---|---|
| Encryption layer | TLS, IPsec, MACsec, service-managed encryption, certificate authority, or DNS security. |
| Path boundary | User to edge, edge to origin, VPC to VPC, on-premises to AWS, service endpoint, or internal workload path. |
| Trust model | Public certificate, private CA, mutual TLS, customer-managed keys, or service-managed trust. |
| Shared responsibility | Which parts AWS encrypts by default and which parts the customer must explicitly configure. |
| Lifecycle | Certificate issuance, renewal, rotation, private key custody, validation, and revocation. |
| Compliance evidence | How the design proves encryption is active and maintained. |
The exam often hides the correct answer in the phrase “where must the encryption terminate?”
Use this map before choosing a service or feature.
flowchart TD
R["Requirement"] --> A{"Application or HTTP traffic?"}
A -- "Yes" --> T["TLS with ACM, ALB, NLB, CloudFront, API, or workload certificates"]
A -- "No" --> N{"Network path needs encryption?"}
N -- "Site-to-site or hybrid" --> I["IPsec VPN, including VPN over Direct Connect when required"]
N -- "Direct Connect physical link" --> M["MACsec on supported dedicated Direct Connect paths"]
N -- "Private service access" --> P["Private endpoint plus TLS or service-native encryption"]
R --> D{"DNS integrity requirement?"}
D -- "Yes" --> S["DNSSEC or secure DNS design for the relevant zone/resolution path"]
The trap is mixing layers. A firewall rule can limit who connects, but it does not encrypt the data. A private route can avoid the public internet, but it does not automatically satisfy every in-transit encryption requirement.
| Requirement | Strongest first fit | Why |
|---|---|---|
| Public users need HTTPS to an application | TLS at CloudFront, ALB, API Gateway, or workload endpoint with ACM-managed certificates where supported. | Protects user-to-service transport and supports normal web trust. |
| Internal service-to-service traffic needs private trust | ACM PCA, private certificates, workload TLS, or mutual TLS where required. | Public certificates are not always the right trust model for private names and internal identities. |
| On-premises to AWS traffic must be encrypted at Layer 3 | AWS Site-to-Site VPN with IPsec. | IPsec protects the network-layer tunnel between gateways. |
| Dedicated Direct Connect traffic must be encrypted over the cross-connect | MACsec on supported dedicated Direct Connect connections or LAGs. | MACsec protects the Layer 2 link between the customer device and Direct Connect location. |
| Direct Connect performance and IPsec confidentiality are both required | VPN over Direct Connect. | Combines private DX connectivity with IPsec tunnel encryption. |
| S3 access must use encrypted transport | Enforce HTTPS with bucket or IAM policy conditions and use appropriate endpoint design. | S3 encryption at rest is separate from HTTPS in transit. |
| DNS authenticity/integrity is required for public DNS | DNSSEC where supported and operationally maintained. | DNSSEC validates DNS data integrity, not application payload confidentiality. |
| Managed database client connections need encryption | Enable and enforce TLS for the database engine/client path. | Database storage encryption does not automatically prove client transport encryption. |
Strong answers name the path and the enforcement point.
TLS protects application transport, but placement changes the security boundary.
| TLS pattern | Exam meaning |
|---|---|
| TLS at CloudFront | Viewer-to-edge encryption, with a separate decision for edge-to-origin encryption. |
| TLS at ALB | Application-layer TLS termination at the load balancer, then a separate target-side encryption choice. |
| TLS passthrough at NLB | Transport connection can pass to targets when the design needs target-side termination. |
| Re-encryption to targets | Maintains encrypted transport after load balancer termination where compliance requires it. |
| Mutual TLS | Both sides authenticate with certificates, useful for high-trust service or client identity requirements. |
| Custom EC2 TLS | Customer manages certificate deployment, private keys, renewal, listener config, and hardening. |
Do not assume “load balancer has TLS” means the entire path is encrypted. The question may require client-to-edge, edge-to-origin, load-balancer-to-target, or end-to-end encryption.
Certificate management is part of confidentiality because weak lifecycle management can break encryption or trust.
| Need | Better fit |
|---|---|
| Public HTTPS certificate for supported AWS services | AWS Certificate Manager public certificate where service and Region rules fit. |
| Private internal trust hierarchy | AWS Private Certificate Authority. |
| Private service identities and internal domains | ACM PCA or another enterprise private CA strategy. |
| Automatic renewal for supported public certificates | ACM-managed renewal when validation remains valid. |
| Exportable private key for arbitrary software | A CA strategy that supports the required key custody model; ACM public certificates generally are deployed to supported services rather than exported. |
| Cross-account certificate use | Plan ownership, sharing, service support, and renewal responsibilities explicitly. |
For ANS-C01, the usual distinction is public web trust versus private enterprise trust. ACM solves many public service certificate needs. ACM PCA solves private CA needs.
Hybrid encryption questions are common because Direct Connect is private but not automatically encrypted end to end.
| Option | Layer | Strong exam cue |
|---|---|---|
| Site-to-Site VPN | Layer 3/IPsec | Encrypt traffic between customer gateway and AWS VPN endpoint, often over the internet or private path. |
| VPN over Direct Connect | Layer 3/IPsec over DX path | Need DX consistency plus IPsec confidentiality. |
| Direct Connect MACsec | Layer 2 | Need encryption on the dedicated cross-connect between customer router and DX location. |
| Application TLS over DX | Application/transport | Need application-level confidentiality independent of network path. |
AWS Direct Connect documentation is explicit that Direct Connect traffic is not encrypted by default. If the prompt requires encryption over Direct Connect, choose a transit encryption option such as VPN over Direct Connect, MACsec where supported, or application TLS depending on the required boundary.
MACsec is useful, but it has a narrow boundary.
| Fact | Exam implication |
|---|---|
| MACsec is Layer 2 point-to-point encryption. | It protects the Ethernet link, not every later hop in an end-to-end application path. |
| It applies to supported dedicated Direct Connect connections and LAGs. | Do not assume every hosted connection can use it. |
| It depends on compatible customer equipment and key material. | Operational readiness matters. |
must_encrypt can fail closed if MACsec cannot be established. |
Strong confidentiality can reduce availability if mismanaged. |
should_encrypt can fall back if encryption cannot be established. |
Availability improves, but compliance may not accept fallback to cleartext. |
The exam may ask for the difference between MACsec and IPsec. MACsec protects a link. IPsec protects a tunnel between network endpoints.
AWS services have different encryption boundaries. Do not assume one answer fits all of them.
| Service or pattern | Confidentiality question to ask |
|---|---|
| CloudFront | Is viewer-to-edge TLS enough, or must edge-to-origin also use HTTPS? |
| ALB | Is TLS terminated at ALB, and does target-side traffic also need encryption? |
| NLB | Is TLS terminated at NLB, passed through, or handled on targets? |
| Amazon S3 | Are clients required to use HTTPS, and are bucket policies enforcing it? |
| Managed databases | Does the database engine require TLS for clients, and is certificate rotation handled? |
| EC2 custom service | Who owns certificate deployment, cipher policy, renewal, and private key protection? |
| Transit Gateway | Is the routed path private only, or does the requirement demand IPsec/TLS encryption across it? |
| PrivateLink | Private connectivity does not remove the need for TLS when the application or compliance requirement demands it. |
The strongest answer reads the compliance requirement literally. “Private” and “encrypted” are related, but not interchangeable.
DNS confidentiality and DNS integrity are not the same thing. ANS-C01 specifically calls out secure DNS communications and DNSSEC.
| Requirement | Stronger answer |
|---|---|
| Prove public DNS responses were not tampered with | DNSSEC signing and validation where supported. |
| Control which domains workloads can resolve | Route 53 Resolver DNS Firewall, not DNSSEC alone. |
| Observe DNS queries from VPC workloads | Route 53 Resolver query logs. |
| Keep private names private inside AWS or hybrid networks | Private hosted zones, Resolver endpoints, and rule design. |
| Encrypt application payload after DNS resolution | TLS, not DNSSEC. |
DNSSEC provides authenticity and integrity for DNS data. It does not encrypt the application connection and it is not a substitute for TLS.
AWS provides many encryption-capable services, but the customer often chooses where to enable and enforce encryption.
| Prompt wording | What to check |
|---|---|
| “Compliance requires encryption in transit” | Which hop is in scope and whether that hop is explicitly encrypted. |
| “Direct Connect private connection” | Direct Connect alone is not the same as encrypted transit. |
| “Managed database” | Client TLS enforcement and certificate handling, not only storage encryption. |
| “Internal service mesh” | Private CA, mutual TLS, certificate rotation, and workload identity. |
| “Public website” | Viewer TLS, certificate trust, redirect to HTTPS, and origin encryption if required. |
| “DNS tampering concern” | DNSSEC for DNS integrity plus TLS for application data. |
If the answer relies on “AWS handles it” without naming the encrypted hop, it is usually too vague for ANS-C01.
| Stem clue | Weak answer | Stronger answer |
|---|---|---|
| “DX must be encrypted” | Direct Connect private VIF only | VPN over Direct Connect, MACsec where supported, or application TLS depending on boundary. |
| “end-to-end HTTPS” | TLS only at ALB | Re-encrypt to targets or terminate TLS on the workload when required. |
| “private internal certs” | Public ACM certificate for every private name | ACM PCA or enterprise private CA design. |
| “DNS integrity” | Security group rule | DNSSEC where applicable. |
| “S3 must reject unencrypted transport” | S3 default encryption only | Enforce HTTPS with policy conditions. |
| “EC2 custom TLS service” | Assume ACM installs certs everywhere | Plan certificate deployment, key custody, renewal, and listener configuration. |
| “MACsec requirement” | Hosted DX connection by assumption | Verify supported dedicated connection, LAG, location, device, and encryption mode. |
A company uses AWS Direct Connect for predictable hybrid connectivity. A new compliance requirement states that traffic between the corporate data center and AWS must be encrypted in transit. The team wants to preserve the Direct Connect path and use AWS-managed VPN endpoints rather than deploying custom EC2 encryption appliances. Which option is strongest?
Answer: Run AWS Site-to-Site VPN over Direct Connect.
Why: Direct Connect provides private connectivity, but AWS states that Direct Connect traffic is not encrypted in transit by default. VPN over Direct Connect keeps the private connectivity path while adding IPsec encryption between the customer gateway and AWS VPN endpoint. DNSSEC protects DNS integrity, not the hybrid traffic payload.
For ANS-C01 confidentiality questions, first identify the protected hop: viewer to edge, edge to origin, load balancer to target, service to service, on-premises to AWS, Direct Connect cross-connect, database client path, S3 client path, or DNS response path. Then choose TLS, IPsec, MACsec, ACM, ACM PCA, DNSSEC, or service policy enforcement for that specific boundary.
Continue with the ANS-C01 Cheat Sheet for a compact review of the design, implementation, operations, and security decisions across the exam.