DEA-C01 Question 487
Select 2Your organization needs to process sensitive financial data using Amazon EMR and store the results in Amazon S3. To comply with regulatory requirements, all data must be encrypted both at rest and in transit. Which of the following configurations ensure compliance with these requirements?
- A
Enable server-side encryption with Amazon S3-managed keys (SSE-S3) for data stored in Amazon S3.
- B
Enable client-side encryption in your application before uploading data to Amazon S3 and use HTTPS for data transfer.
- C
Configure Amazon EMR to use AWS Key Management Service (AWS KMS) for encryption at rest and enable in-transit encryption.
- D
Use Amazon EMR with encryption keys managed by the Hadoop Key Management Server (Hadoop KMS) for at-rest encryption.
- E
Disable in-transit encryption on Amazon EMR and rely only on at-rest encryption to reduce overhead.
Show answer and explanation
Correct answers: B, C
Explanation
To comply with the requirement for encryption both at rest and in transit, you must ensure that your solution addresses both aspects. Client-side encryption combined with HTTPS (Option 2) ensures that data is encrypted before upload and during transfer. Configuring Amazon EMR with AWS KMS and enabling in-transit encryption (Option 3) provides a managed approach to encrypting data at rest and in transit within the EMR cluster. These configurations satisfy the regulatory requirements for sensitive financial data.
- A. Incorrect.
Server-side encryption with SSE-S3 encrypts data at rest but does not address encryption in transit, which is required for compliance in this scenario.
- B. Correct.
Client-side encryption ensures data is encrypted before it is uploaded to Amazon S3, and using HTTPS ensures data is encrypted in transit, meeting both requirements.
- C. Correct.
AWS KMS provides strong encryption for data at rest, and Amazon EMR's in-transit encryption ensures that data is encrypted during transfer between nodes, fulfilling the compliance requirements.
- D. Incorrect.
While Hadoop KMS can manage at-rest encryption, it does not provide in-transit encryption. Therefore, it does not fully meet the compliance requirements.
- E. Incorrect.
Disabling in-transit encryption does not comply with the requirement to encrypt data in transit, making this option invalid.