DEA-C01 Question 485
Select 3Your organization is processing sensitive customer data using AWS analytics services such as Amazon Redshift, Amazon EMR, and AWS Glue. As a data engineer, you are tasked with ensuring all data is encrypted both at rest and in transit. Which of the following options would meet the encryption requirements across these services?
- A
Enable Amazon Redshift's encryption with AWS Key Management Service (KMS) keys and configure SSL connections for data in transit.
- B
Use Amazon EMR with server-side encryption using S3 managed encryption keys (SSE-S3) and enable TLS for communication between EMR nodes.
- C
Configure AWS Glue to use AWS Key Management Service (KMS) for encryption of job metadata and enable SSL for data transfers.
- D
Use Amazon Redshift's default encryption without any additional configurations and disable SSL to improve performance.
- E
Enable client-side encryption for all services and avoid using AWS managed encryption keys.
Show answer and explanation
Correct answers: A, B, C
Explanation
To ensure encryption at rest and in transit across AWS analytics services, you must configure service-specific encryption options. Amazon Redshift supports encryption using AWS KMS keys and SSL for in-transit encryption. Amazon EMR supports SSE-S3 for data at rest and TLS for node communication. AWS Glue supports KMS for metadata encryption and SSL for secure transfers. These configurations meet the encryption requirements and align with AWS best practices.
- A. Correct.
This is correct. Amazon Redshift supports encryption at rest using AWS KMS keys and encryption in transit through SSL, ensuring data is secure in both states.
- B. Correct.
This is correct. Amazon EMR supports server-side encryption using SSE-S3 for data at rest and TLS for secure communication between nodes, fulfilling the encryption requirements.
- C. Correct.
This is correct. AWS Glue can be configured to encrypt job metadata using AWS KMS and secure data transfers using SSL, meeting the encryption needs.
- D. Incorrect.
This is incorrect. Amazon Redshift's default encryption without AWS KMS keys may not meet strict compliance requirements, and disabling SSL would compromise data security during transit.
- E. Incorrect.
This is incorrect. While client-side encryption can be used, it is not a practical or recommended approach for AWS analytics services when AWS managed encryption options are available.