A genomics lab runs EMR on EC2 with Spark shuffling sensitive data between nodes across AZs and must encrypt all inter-node traffic with TLS using a reusable cluster-level setting, without hand-building a certificate authority (EMR release 7.11 or later). Which inter-resource encryption control secures EMR node traffic?
Select an answer to reveal the explanation.
Short Explanation
Your cluster whispers secrets node to node and needs a private language. EMR in-transit encryption in a security configuration wraps Hadoop and Spark shuffle traffic in TLS.
Full Explanation
The correct control uses an EMR security configuration with in-transit encryption set to EMR-created and managed private certificates, which automatically provisions certificates to every EC2 node and enforces TLS for Hadoop RPC, Spark shuffle and other inter-node traffic across Availability Zones, and because the configuration is a named reusable resource it can be attached to any new cluster without building or operating a private authority, the streamlined behavior available in EMR 7.11 and later. Supplying custom PEM certificates issued by an enterprise authority in the same security configuration is a valid enterprise pattern for centralized trust but fails the stated constraint because the team must still procure, distribute and rotate an external authority and key material. Distributing Hadoop keystores through bootstrap actions to enable native RPC encryption is historically common for manual control but fails the reusable managed requirement because it depends on per-cluster scripting and self-managed distribution rather than a centrally managed cluster-level setting. Enabling EMRFS TLS plus server-side encryption for transfers between nodes and Amazon S3 is best practice for storage I/O but fails the scope requirement because it protects only the cluster-to-storage path and leaves east-west shuffle traffic between EC2 nodes unencrypted. For exams, carefully separate at-rest volume encryption, cluster-to-S3 transfer encryption, and node-to-node in-transit encryption, since stems often include all three and only one matches inter-node TLS, and in practice verify the launch uses the intended security configuration, the provider shows EMR-managed certificates, and shuffle metrics confirm TLS negotiation.