DEA-C01 Question 412
Select 3You are designing a data lake on Amazon S3 to store sensitive financial data. To comply with your organization's data security and governance policies, you need to ensure the data is encrypted at rest, access is granted only to specific roles, and all access is logged for auditing purposes. Which combination of steps should you take to meet these requirements?
- A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) for S3 buckets.
- B
Use S3 Bucket Policies to restrict access to specific IAM roles.
- C
Enable Amazon S3 Server Access Logging to capture access requests to the bucket.
- D
Disable versioning on the S3 bucket to reduce storage costs.
- E
Grant public read access to the bucket for easier sharing of data.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the organization's security and governance requirements, you must ensure sensitive financial data is encrypted at rest, access is restricted to authorized roles, and access activities are logged for auditing. Enabling SSE-KMS ensures encryption, S3 Bucket Policies enforce access control, and S3 Server Access Logging provides the necessary audit trail. Disabling versioning or granting public access would compromise security and compliance.
- A. Correct.
Correct. Enabling server-side encryption with AWS KMS (SSE-KMS) ensures that your data is encrypted at rest using a customer-managed key, which is essential for handling sensitive financial data.
- B. Correct.
Correct. S3 Bucket Policies can be configured to allow access only to specific IAM roles, ensuring secure access control in compliance with governance policies.
- C. Correct.
Correct. Enabling S3 Server Access Logging provides detailed records of access requests, which is critical for auditing purposes and meeting compliance requirements.
- D. Incorrect.
Incorrect. Disabling versioning does not contribute to security or governance and could result in the loss of prior versions of critical files, which may be required for compliance.
- E. Incorrect.
Incorrect. Granting public read access violates the principle of least privilege and exposes sensitive financial data, leading to serious security and compliance risks.