CLF-C02 Question 89
Select 3A company wants to store sensitive customer information in Amazon S3 and ensure it is encrypted to meet compliance requirements. They also want the data to be encrypted while being transmitted to and from the S3 bucket. Which combination of encryption options should they use?
- A
Enable Server-Side Encryption with Amazon S3-managed keys (SSE-S3) for data at rest
- B
Use SSL/TLS for encrypting data in transit
- C
Enable Server-Side Encryption with customer-provided keys (SSE-C) for data at rest
- D
Disable encryption in transit and only use Server-Side Encryption for data at rest
Show answer and explanation
Correct answers: A, B, C
Explanation
To secure sensitive customer information in S3, encryption should be applied both at rest and in transit. Options like SSE-S3 and SSE-C can be used for encrypting data at rest, while SSL/TLS ensures that data is encrypted during transmission to and from the S3 bucket. Disabling encryption in transit would not meet compliance requirements or best practices for securing data.
- A. Correct.
Correct: Enabling Server-Side Encryption with Amazon S3-managed keys (SSE-S3) ensures that data at rest within the S3 bucket is encrypted using keys managed by AWS.
- B. Correct.
Correct: Using SSL/TLS encrypts data in transit, ensuring that data sent to and from the S3 bucket remains secure.
- C. Correct.
Correct: Server-Side Encryption with customer-provided keys (SSE-C) is another valid option for encrypting data at rest, as it allows customers to manage their own encryption keys.
- D. Incorrect.
Incorrect: Disabling encryption in transit would expose data to potential interception during transmission and is not a secure or compliant practice.