DEA-C01 Question 410
Select 3You are designing a data pipeline on AWS to process sensitive customer data. The pipeline ingests the data into Amazon S3, processes it using AWS Glue, and stores the processed results in Amazon Redshift. To ensure compliance with your organization's data governance policies, you must implement encryption for data at rest and in transit. Which of the following approaches will meet these requirements?
- A
Enable server-side encryption (SSE-S3) on the Amazon S3 bucket and use SSL/TLS for data transfers.
- B
Use AWS Glue to process data without enabling encryption for temporary storage and use server-side encryption on Amazon Redshift.
- C
Enable server-side encryption (SSE-KMS) on both Amazon S3 and Amazon Redshift, and configure AWS Glue to use AWS KMS for temporary storage.
- D
Use client-side encryption for Amazon S3, configure Amazon Redshift to use AWS KMS, and enable SSL for connections to Amazon Redshift.
Show answer and explanation
Correct answers: A, C, D
Explanation
Data security and governance require encryption for data at rest and in transit. Approaches 1, 3, and 4 meet these requirements by using AWS-provided encryption mechanisms like SSE-S3, SSE-KMS, and AWS KMS, as well as ensuring encryption during transit with SSL/TLS. Option 2 is incorrect because it does not enable encryption for temporary storage in AWS Glue, which is a critical part of the pipeline.
- A. Correct.
This is a valid approach as enabling SSE-S3 encrypts data at rest in Amazon S3, and using SSL/TLS ensures data is encrypted during transit.
- B. Incorrect.
This is incorrect because not enabling encryption for temporary storage in AWS Glue violates the requirement to encrypt data at rest throughout the pipeline.
- C. Correct.
This is a valid approach as enabling SSE-KMS ensures strong encryption for data at rest, and configuring AWS Glue to use AWS KMS protects temporary storage during processing.
- D. Correct.
This is a valid approach as client-side encryption ensures data at rest is protected in Amazon S3, AWS KMS secures Amazon Redshift, and SSL ensures encryption during transit.