DEA-C01 Question 495
Select 3You are a data engineer working on an AWS-based pipeline that processes sensitive customer data, including personally identifiable information (PII). The data is stored in Amazon S3, and you need to ensure that the data is protected both at rest and in transit. Which combination of actions should you take to meet this requirement?
- A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) for the S3 bucket.
- B
Use Amazon S3 Transfer Acceleration to ensure faster upload speeds for the sensitive data.
- C
Enable default encryption on the S3 bucket and configure it to use AES-256 encryption.
- D
Use Amazon S3 bucket policies to enforce HTTPS connections for all read and write operations.
- E
Enable versioning on the S3 bucket to maintain backups for sensitive data.
Show answer and explanation
Correct answers: A, C, D
Explanation
To protect sensitive data, you must ensure encryption both at rest and in transit. Server-side encryption with SSE-KMS or default AES-256 encryption on the S3 bucket protects data at rest, while enforcing HTTPS ensures encryption in transit. These actions collectively meet the requirements for securing sensitive data in your pipeline.
- A. Correct.
Correct: Enabling SSE-KMS ensures server-side encryption for data at rest using AWS Key Management Service, providing additional control over encryption keys.
- B. Incorrect.
Incorrect: While S3 Transfer Acceleration improves upload speeds, it does not contribute directly to protecting sensitive data.
- C. Correct.
Correct: Configuring default encryption on the S3 bucket with AES-256 ensures all objects are encrypted by default, meeting the requirement for data protection at rest.
- D. Correct.
Correct: Enforcing HTTPS ensures data is encrypted in transit, protecting sensitive information from being intercepted.
- E. Incorrect.
Incorrect: Enabling versioning is useful for data recovery but does not directly address encryption or protection of sensitive data at rest or in transit.