ANS-C01 Question 505
Select 3Your organization is using Amazon S3 to store sensitive customer data. To comply with regulatory requirements, the data must be encrypted both in transit and at rest. Under the AWS Shared Responsibility Model, which of the following actions are your responsibility as a customer to ensure proper encryption of the data?
- A
Enabling server-side encryption (SSE) for objects stored in S3
- B
Ensuring that HTTPS is used when uploading or downloading data to S3
- C
Maintaining the physical security of the data stored in AWS data centers
- D
Configuring and managing your own customer-managed keys (CMKs) in AWS Key Management Service (KMS) if required
- E
Monitoring network traffic for unauthorized access to ensure data encryption in transit
Show answer and explanation
Correct answers: A, B, D
Explanation
Under the AWS Shared Responsibility Model, AWS is responsible for the security 'of' the cloud, including the physical infrastructure and managed services like AWS KMS. However, customers are responsible for the security 'in' the cloud, which includes configuring encryption options (e.g., enabling server-side encryption for S3), ensuring secure communication (e.g., using HTTPS), and managing encryption keys if customer-managed keys (CMKs) are used. Physical security of data centers is handled by AWS, and while monitoring traffic is important, the customer’s responsibility regarding encryption in transit is to ensure secure protocols like HTTPS are used.
- A. Correct.
Correct. Enabling server-side encryption is a customer responsibility to ensure that data is encrypted at rest. AWS provides multiple options for server-side encryption, but it is the customer's responsibility to configure this.
- B. Correct.
Correct. Ensuring the use of HTTPS (TLS) for secure communication when transferring data to and from S3 is part of the customer's responsibility to secure data in transit.
- C. Incorrect.
Incorrect. Maintaining the physical security of AWS data centers is AWS's responsibility under the Shared Responsibility Model.
- D. Correct.
Correct. If you choose to use customer-managed keys (CMKs) for encryption, it is your responsibility to create, configure, and manage them in AWS KMS.
- E. Incorrect.
Incorrect. AWS provides tools like VPC Flow Logs and CloudTrail for traffic monitoring, but ensuring encryption in transit is achieved by using HTTPS, which is the customer's responsibility.