DEA-C01 Question 486
Select 3A data engineering team is using Amazon Redshift, Amazon EMR, and AWS Glue to process and analyze sensitive customer data. The team needs to ensure data is encrypted both at rest and in transit. Which of the following options are valid encryption mechanisms provided by these services to meet the requirements?
- A
Use AWS Key Management Service (KMS) to manage encryption keys for data at rest in Amazon Redshift.
- B
Enable Transport Layer Security (TLS) for encrypting data in transit in Amazon EMR.
- C
Use client-side encryption to encrypt data before uploading it to AWS Glue's managed storage.
- D
Enable AWS-managed Customer Master Keys (CMKs) to encrypt metadata and logs generated by Amazon Redshift.
- E
Use Amazon S3's default server-side encryption (SSE-S3) for intermediate data storage in AWS Glue.
Show answer and explanation
Correct answers: A, B, E
Explanation
To ensure data is encrypted both at rest and in transit, AWS analytics services such as Amazon Redshift, Amazon EMR, and AWS Glue provide various encryption mechanisms. Amazon Redshift integrates with AWS KMS for encryption at rest, while Amazon EMR supports TLS for protecting data in transit. AWS Glue frequently uses Amazon S3 for intermediate storage, where SSE-S3 can ensure encryption at rest.
- A. Correct.
Correct: Amazon Redshift integrates with AWS KMS to encrypt data at rest using Customer Master Keys (CMKs). This option meets the encryption-at-rest requirement.
- B. Correct.
Correct: Amazon EMR supports Transport Layer Security (TLS) for secure communication between nodes and for protecting data in transit.
- C. Incorrect.
Incorrect: While client-side encryption is a valid option for some services, it is not directly a built-in feature of AWS Glue. AWS Glue relies on AWS-managed encryption mechanisms for both data at rest and in transit.
- D. Incorrect.
Incorrect: AWS-managed CMKs are not specifically used to encrypt metadata and logs in Amazon Redshift. Metadata and logs encryption depend on the service's logging configuration, such as CloudWatch or S3 encryption settings.
- E. Correct.
Correct: AWS Glue often uses Amazon S3 for intermediate data storage. You can enable server-side encryption (SSE-S3) to encrypt data at rest in S3 buckets.