DEA-C01 Question 492
Single answerYou are working as a data engineer and need to ensure that sensitive data stored in an Amazon S3 bucket is encrypted. Your organization mandates that encryption keys must be fully controlled by your internal security team and should not be managed by AWS. Which type of encryption should you implement to meet this requirement?
- A
Client-side encryption
- B
Server-side encryption with Amazon S3-managed keys (SSE-S3)
- C
Server-side encryption with AWS Key Management Service (SSE-KMS)
- D
Server-side encryption with customer-provided keys (SSE-C)
Show answer and explanation
Correct answer: A
Explanation
Client-side encryption ensures that the encryption and decryption processes occur entirely outside AWS, giving the organization full control over encryption keys. This is the best option when key management must remain internal and independent of AWS.
- A. Correct.
Correct. Client-side encryption allows you to encrypt data before uploading it to S3, and you have full control over encryption keys because they are managed outside AWS.
- B. Incorrect.
Incorrect. SSE-S3 uses keys managed entirely by AWS, which does not meet the organization's requirement to manage keys internally.
- C. Incorrect.
Incorrect. SSE-KMS involves AWS Key Management Service for managing keys, which still relies on AWS for key management and does not meet the organization's requirement for full internal control.
- D. Incorrect.
Incorrect. While SSE-C allows you to provide your own encryption keys, the encryption and decryption processes are managed by AWS, which means encryption does not occur entirely outside AWS.