DEA-C01 Question 493
Select 2A company is storing sensitive customer data in Amazon S3 and wants to ensure data is encrypted. The company is considering both client-side encryption and server-side encryption. Which of the following statements correctly describes the difference between client-side encryption and server-side encryption?
- A
With client-side encryption, the encryption and decryption process occurs on the client side before data is uploaded or retrieved from S3.
- B
Server-side encryption requires the client to manage encryption keys locally and ensure their security.
- C
Client-side encryption is fully managed by AWS, while server-side encryption requires customers to implement encryption logic in their application.
- D
Server-side encryption encrypts data at rest in S3, while client-side encryption ensures data is encrypted before reaching S3.
Show answer and explanation
Correct answers: A, D
Explanation
The main difference between client-side and server-side encryption is where the encryption and decryption processes occur. In client-side encryption, the client is responsible for encrypting data before sending it to AWS, and AWS stores the already-encrypted data in S3. In server-side encryption, AWS takes the responsibility of encrypting data after it is uploaded and decrypts it when it is accessed, ensuring encryption at rest. Understanding where encryption takes place and who manages the encryption keys is critical for designing secure and compliant solutions in AWS.
- A. Correct.
Correct: In client-side encryption, the client is responsible for encrypting and decrypting data before uploading to or retrieving from S3. AWS does not perform encryption for client-side encryption.
- B. Incorrect.
Incorrect: This describes a characteristic of client-side encryption, not server-side encryption. Server-side encryption is fully managed by AWS.
- C. Incorrect.
Incorrect: This is the opposite of how encryption methods work. Client-side encryption requires the client to manage encryption keys and logic, while server-side encryption is typically managed by AWS.
- D. Correct.
Correct: Server-side encryption ensures data is encrypted at rest within S3 after it is uploaded, while client-side encryption ensures data is already encrypted before it is sent to S3.