Deploy the tokenization code on AWS Nitro Enclaves for an isolated, attestable environment

SCS-C02 By islever Editorial Last updated

Design and implement security controls for compute workloads. Design and implement controls that provide confidentiality and integrity for data at rest.

Short answer

D Deploy the tokenization code on AWS Nitro Enclaves for an isolated, attestable environment that other components cannot reach.

Question

A security engineer is designing a cloud architecture to support an application. The application runs on Amazon EC2 instances and processes sensitive information, including credit card numbers. The application will send the credit card numbers to a component that is running in an isolated environment. The component will encrypt, store, and decrypt the numbers. The component then will issue tokens to replace the numbers in other parts of the application. The component of the application that manages the tokenization process will be deployed on a separate set of EC2 instances. Other components of the application must not be able to store or access the credit card numbers. Which solution will meet these requirements?
  1. Use EC2 Dedicated Instances for the tokenization component of the application.
  2. Place the EC2 instances that manage the tokenization process into a partition placement group.
  3. Create a separate VPDeploy new EC2 instances into the separate VPC to support the data tokenization.
  4. Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances. Correct Answer

Key Takeaways

Nitro Enclaves (D) are isolated, hardened VMs with no persistent storage, no external networking, and no operator access, verified by cryptographic attestation—ideal for processing highly sensitive data like PANs. Dedicated Instances (A) are just tenancy isolation, not data isolation; a partition placement group (B) is for spread, not security; a separate VPC (C) still allows network reachability and operator access. D is the only true isolation control.

Credit-card tokenization must run in an isolated environment that other application components cannot reach, handling encryption, storage, decryption, and token issuance. AWS Nitro Enclaves provide a hardened, isolated compute environment attached to an EC2 instance with no external interaction, no operator access, and cryptographic attestation, so only the tokenization code can see the PANs while the rest of the app cannot store or access them.

Common mistake: Using Dedicated Instances (A)—that only controls hardware tenancy, not data isolation from other components. A partition placement group (B)—a placement strategy for fault isolation, not sensitive-data isolation. A separate VPC (C)—network isolation but components can still be reached and operators can access them; not the hardened, attestable boundary Nitro Enclaves provide.

Expert Analysis

Why the Answer Is Correct

AWS Nitro Enclaves provide an isolated compute environment for EC2 with no external interaction, no persistent storage, and no operator or application access except through a local vsock channel, all verifiable via cryptographic attestation. Deploying the tokenization code there ensures only that enclave can process the credit-card numbers, while other components of the application cannot store or access them—meeting the isolation requirement.

Why the Other Options Are Wrong

A (Dedicated Instances) only affects hardware tenancy, not data isolation between components. B (partition placement group) is a fault-isolation placement strategy, not a security boundary. C (separate VPC) provides network separation but instances remain reachable and operator-accessible, unlike the enclave's hardened, attestable boundary. D is correct.

Community Comment Notes

Community voted D (100). Commenters described Nitro Enclaves as an isolated, attestable environment purpose-built for processing highly sensitive data like credit-card numbers, keeping them away from other application components. D confirmed.

Official Reference

https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclaves.html

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. IPLogic 👍 1 Answered D
    The best solution to meet these requirements is: D. Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances. AWS Nitro Enclaves provide an isolated environment that is ideal for processing sensitive data, such as credit card numbers. They offer strong security guarantees by isolating the tokenization process from other components of the application, ensuring that sensitive data is protected and inaccessible to unauthorized components
  2. VPNalumni 👍 1
    D. Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances. Explanation: AWS Nitro Enclaves provide isolated compute environments to process highly sensitive data, ensuring that other components cannot access the credit card numbers. Nitro Enclaves are specifically designed for secure processing of confidential information, making them ideal for tokenization tasks. https://aws.amazon.com/ec2/nitro/nitro-enclaves/
  3. mikelord 👍 1
    Option D, deploying the tokenization component onto AWS Nitro Enclaves, is the best solution. Nitro Enclaves provide a highly secure, isolated environment that can handle the encryption, storage, and tokenization of sensitive information without exposing it to other parts of the application, meeting the requirements for both isolation and data security.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide