A genomics lab processes sensitive datasets on Amazon EMR with multi-node Spark clusters in a single VPC. Compliance mandates that all inter-node shuffle and HDFS replication traffic be encrypted in transit using certificates that EMR provisions to every node without custom code. Which control should the data engineer configure for inter-resource encryption in transit?
Select an answer to reveal the explanation.
Short Explanation
Shuffle traffic whispers secrets between workers, so you must seal those hallways with in-transit-encryption. EMR security configs wrap node chatter in TLS without code changes.
Full Explanation
EMR security configurations enable in-transit encryption using TLS with certificates that EMR creates and manages (release 7.11 and later), or PEM or custom-provider certificates, to encrypt Hadoop RPC, shuffle, and HDFS replication between nodes, distributing the artifacts to every node automatically and independent of storage encryption. S3 server-side encryption with KMS protects data at rest in buckets and logs but does not encrypt network traffic between cluster nodes, leaving shuffle in clear text. Attaching Nitro Enclaves provides isolated compute for sensitive processing but does not provide cluster-wide TLS for EMR inter-node communication and is not the EMR-native mechanism. Configuring EBS encryption by default protects attached volume data at rest, not traffic on the wire between nodes. For the exam separate in-transit TLS for EMR, EKS, and SageMaker from at-rest KMS encryption, and in practice verify the security configuration is attached to clusters and certificate validity is tracked and renewed before expiry.