DEA-C01 Question 497
Select 3You are designing a data pipeline on AWS to process financial transactions. The data contains sensitive customer information, including Personally Identifiable Information (PII). Which combination of actions will ensure the protection of sensitive data at rest and in transit while adhering to compliance requirements?
- A
Enable server-side encryption (SSE) with AWS Key Management Service (KMS) for storage services like Amazon S3.
- B
Use Amazon Macie to detect and protect sensitive data in your S3 buckets.
- C
Use unencrypted HTTP connections to transfer data between AWS services to optimize performance.
- D
Enable Amazon S3 Object Lock to enforce write-once-read-many (WORM) compliance for sensitive data.
- E
Encrypt data in transit using TLS when transferring data between systems.
Show answer and explanation
Correct answers: A, B, E
Explanation
To protect sensitive data, it is crucial to implement encryption both at rest and in transit, and to use AWS services like Amazon Macie to identify and manage sensitive data. Server-side encryption with AWS KMS ensures data is encrypted in storage, while TLS protects data during transfer. Unencrypted HTTP connections should never be used for transferring sensitive data. Although S3 Object Lock is useful for compliance purposes, it does not specifically address the encryption of sensitive data.
- A. Correct.
Enabling server-side encryption with AWS KMS ensures that sensitive data stored in Amazon S3 or other storage services is encrypted at rest, providing an additional layer of security.
- B. Correct.
Amazon Macie helps detect and protect sensitive data by using machine learning to classify and highlight PII or sensitive information in your S3 buckets.
- C. Incorrect.
Using unencrypted HTTP connections to transfer data exposes it to potential interception and is not a secure practice for handling sensitive information.
- D. Incorrect.
Amazon S3 Object Lock enforces WORM compliance for regulatory data but does not directly address encryption or the protection of sensitive data.
- E. Correct.
Encrypting data in transit using TLS ensures that the data is protected from unauthorized access during transfer, which is critical for securing sensitive information.