CLF-C02 Question 88
Select 2You are designing a new application on AWS that processes sensitive customer data. Security requirements mandate that the data should be encrypted at rest and in transit. Which of the following AWS services and features can help you meet this requirement? (Select TWO)
- A
AWS Key Management Service (KMS) for managing encryption keys
- B
Amazon S3 Server-Side Encryption (SSE) for encrypting data at rest
- C
AWS CloudTrail for logging API activity
- D
AWS Shield for protecting against Distributed Denial of Service (DDoS) attacks
- E
AWS Certificate Manager (ACM) for managing SSL/TLS certificates
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirement of encrypting both data at rest and in transit, AWS Key Management Service (KMS) can be used to manage encryption keys for both scenarios, while Amazon S3 Server-Side Encryption (SSE) specifically addresses encryption at rest. Other options like CloudTrail and Shield are useful for security but do not directly address the encryption requirements.
- A. Correct.
AWS Key Management Service (KMS) is a managed service that allows you to create and control encryption keys, which can be used to encrypt data both at rest and in transit.
- B. Correct.
Amazon S3 Server-Side Encryption (SSE) is specifically designed to encrypt data at rest stored in Amazon S3 buckets, meeting the encryption at rest requirement.
- C. Incorrect.
AWS CloudTrail is a logging service used for tracking API calls and activity in your AWS account. It does not provide encryption capabilities.
- D. Incorrect.
AWS Shield is a service designed to protect applications from DDoS attacks and does not facilitate encryption of data at rest or in transit.
- E. Incorrect.
AWS Certificate Manager (ACM) helps manage SSL/TLS certificates for securing data in transit, but it does not handle encryption at rest.