DEA-C01 Question 411
Select 4You are a data engineer working for a financial institution. Your team is using Amazon S3 to store sensitive customer data, and you need to ensure compliance with data governance policies, including encryption and access control. Which combination of actions should you take to secure the data and meet compliance standards?
- A
Enable default encryption on the S3 bucket using an AWS Key Management Service (KMS) key.
- B
Use S3 Access Points to control access to specific customer subsets in the bucket.
- C
Grant public read access to the bucket for easy data sharing among stakeholders.
- D
Enable S3 Object Lock in compliance mode to prevent object deletion or modification.
- E
Use bucket policies to allow access only to specific IAM roles and accounts.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To secure sensitive data on Amazon S3 and meet compliance standards, you must implement encryption, fine-grained access controls, and data immutability. Enabling AWS KMS-based encryption secures data at rest. S3 Access Points help enforce access controls for specific data subsets. Enabling S3 Object Lock in compliance mode ensures data immutability, and bucket policies can restrict access to authorized roles and accounts. Granting public read access, however, is a security risk and violates governance policies.
- A. Correct.
Enabling default encryption with an AWS KMS key ensures that all objects are encrypted at rest, which is a best practice for securing sensitive data.
- B. Correct.
S3 Access Points allow fine-grained access control for different applications and users, which can help meet governance requirements for accessing subsets of sensitive data.
- C. Incorrect.
Granting public read access exposes sensitive customer data to unauthorized users, violating governance and security policies, and should be avoided.
- D. Correct.
S3 Object Lock in compliance mode ensures objects cannot be deleted or modified, meeting regulatory requirements for data immutability in financial systems.
- E. Correct.
Using bucket policies to restrict access to specific IAM roles and accounts ensures only authorized entities can access the data, aligning with governance and security best practices.