A retail bank runs Amazon EMR with 20 worker nodes to score card transactions. Auditors require shuffle and RPC traffic between nodes to be TLS-encrypted, S3 spill data to use KMS, and settings to be reusable across clusters. Which inter-node encryption control provides compliant EMR transit protection?
Select an answer to reveal the explanation.
Short Explanation
You nailed the gap between VPC isolation and actual wire encryption. Your shuffle traffic stays scrambled with in-transit-encryption like sealed envelopes between couriers, not just locked rooms.
Full Explanation
EMR security configurations provide a reusable template that separately enables at-rest encryption with KMS and in-transit encryption for inter-node shuffle, RPC and HDFS traffic using a TLS certificate provider such as PEM certificates stored in S3, a custom provider, or (EMR 7.11 and later) EMR-created private certificates, and the configuration is attached at cluster launch so every node negotiates TLS without application changes. Enabling at-rest encryption for local disks with KMS and IMDSv2 hardens storage and metadata access but leaves shuffle traffic in cleartext on the cluster network, so it fails the TLS inter-node requirement. Launching in a private VPC subnet with TLS-only S3 endpoint policy protects the cluster perimeter and the S3 path but does not encrypt node-to-node RPC and shuffle inside the subnet, so compliance still fails. Enabling Kerberos authentication provides strong mutual authentication and authorization for applications but does not by itself provide wire encryption unless in-transit encryption is also configured, so traffic remains exposed; for the exam remember in-transit requires an explicit security configuration with a certificate provider distinct from at-rest KMS, and in practice verify in the console that both encryption blocks show enabled and test cluster recreation with the same named configuration.