CLF-C02 Question 78
Single answerA company needs to ensure that its data stored in Amazon S3 is protected from unauthorized access while maintaining compliance with regulatory requirements. Which feature or service of AWS should the company use to achieve this?
- A
Enable server-side encryption with S3-managed keys (SSE-S3)
- B
Use Amazon Macie to automatically encrypt all S3 objects
- C
Enable AWS WAF to block unauthorized access to S3 buckets
- D
Implement AWS Key Management Service (KMS) with customer-managed keys for S3 encryption
Show answer and explanation
Correct answer: A
Explanation
Server-side encryption with S3-managed keys (SSE-S3) is a straightforward and AWS-managed solution for encrypting data at rest in Amazon S3. It is designed to meet compliance and security requirements while minimizing customer management of encryption keys. While other options like AWS KMS can also provide encryption, SSE-S3 is simpler to implement and satisfies the company's needs for data protection and regulatory compliance.
- A. Correct.
Enabling server-side encryption with S3-managed keys (SSE-S3) ensures that data stored in S3 is encrypted at rest and AWS manages the encryption keys. This meets the requirement for data protection and compliance.
- B. Incorrect.
Amazon Macie is a data protection service that helps identify sensitive data, but it does not encrypt S3 objects. It is useful for identifying risks, not directly enforcing encryption.
- C. Incorrect.
AWS WAF is a web application firewall that protects web applications from malicious traffic. It does not provide encryption for S3 buckets or manage compliance for stored data.
- D. Incorrect.
AWS KMS with customer-managed keys is a valid option for encryption, but it is not necessary if the company is looking for a simpler, managed solution like SSE-S3. SSE-S3 already meets the requirements without additional complexity.