DEA-C01 Question 494
Single answerYou are designing a data storage solution for a healthcare organization that stores sensitive patient records on Amazon S3. The organization requires that encryption keys used for securing data must remain under their full control. Which encryption approach should you recommend?
- A
Server-side encryption with Amazon S3-managed keys (SSE-S3)
- B
Server-side encryption with AWS Key Management Service (SSE-KMS)
- C
Server-side encryption with customer-provided keys (SSE-C)
- D
Client-side encryption with customer-managed keys
Show answer and explanation
Correct answer: D
Explanation
The healthcare organization requires full control over encryption keys, which rules out any server-side encryption options where AWS or S3 takes part in managing keys. Client-side encryption with customer-managed keys satisfies this requirement because the organization is solely responsible for key management and encryption operations, ensuring complete control over the entire process.
- A. Incorrect.
Server-side encryption with Amazon S3-managed keys (SSE-S3) does not provide the organization direct control over encryption keys, as the keys are managed by Amazon S3.
- B. Incorrect.
Server-side encryption with AWS Key Management Service (SSE-KMS) allows some level of control over encryption keys via AWS KMS, but the keys are still managed by AWS and do not fulfill the requirement of full control by the organization.
- C. Incorrect.
Server-side encryption with customer-provided keys (SSE-C) allows the organization to provide their own encryption keys, but encryption and decryption are still managed by Amazon S3, not fully meeting the requirement for complete customer control.
- D. Correct.
Client-side encryption with customer-managed keys meets the requirement because the organization retains full control over the encryption keys and performs encryption and decryption on the client side before sending data to or retrieving data from Amazon S3.