DEA-C01 Question 414
Select 3You are a data engineer working for a financial services company that processes sensitive customer data. Your team uses Amazon S3 to store raw and processed datasets. For regulatory compliance, you need to ensure that the data is encrypted at rest and that any unencrypted objects are flagged. Additionally, you must restrict access to the S3 buckets to only specific IAM roles. Which actions should you take to meet these requirements?
- A
Enable S3 bucket default encryption and use a customer-managed AWS Key Management Service (KMS) key.
- B
Enable S3 Object Lock with governance mode to prevent unencrypted objects from being uploaded.
- C
Use an S3 bucket policy to deny access to requests that do not use HTTPS.
- D
Set up an AWS Config rule to check for unencrypted S3 objects and generate alerts.
- E
Use an S3 bucket policy to allow access only to specific IAM roles.
Show answer and explanation
Correct answers: A, D, E
Explanation
To meet the requirements, you need to ensure that data is encrypted at rest and that access to the S3 buckets is restricted to specific IAM roles. Enabling bucket default encryption ensures new objects are encrypted. AWS Config can detect and flag unencrypted objects, helping maintain compliance. Finally, S3 bucket policies can be used to restrict access to specific IAM roles. Other options, such as enabling S3 Object Lock or enforcing HTTPS, are not relevant to the specific requirements in this scenario.
- A. Correct.
Enabling S3 bucket default encryption ensures that all new objects are automatically encrypted at rest using the specified encryption key, which is a core requirement for securing sensitive data.
- B. Incorrect.
S3 Object Lock is designed to prevent object deletions or modifications, not to enforce encryption. This option does not apply to the scenario.
- C. Incorrect.
While enforcing HTTPS is a good security practice, it does not address the requirements of encrypting data at rest or restricting access to specific IAM roles.
- D. Correct.
Using an AWS Config rule helps monitor and flag unencrypted objects, ensuring compliance with the requirement to identify unencrypted data.
- E. Correct.
Using an S3 bucket policy to allow access only to specific IAM roles ensures that access is restricted to the required entities, meeting the access control requirement.