DEA-C01 Question 499
Select 4You are a data engineer working for a healthcare company that processes sensitive patient data in an Amazon S3 bucket. The company requires all stored data to be encrypted and access tightly controlled. Additionally, the company must comply with strict regulatory requirements for auditing access to sensitive data. Which combination of AWS features should you implement to meet these requirements?
- A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) for the S3 bucket.
- B
Use S3 bucket policies to restrict access to specific IAM roles and accounts.
- C
Enable S3 Transfer Acceleration to improve data upload speed and security.
- D
Enable S3 Access Logs or AWS CloudTrail logging for monitoring access to the S3 bucket.
- E
Use Amazon Macie to automatically discover, classify, and protect sensitive data.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To protect sensitive data in an S3 bucket while meeting compliance requirements, you need to encrypt the data (SSE-KMS), restrict access (bucket policies), monitor access (S3 Access Logs or CloudTrail), and classify sensitive data automatically (Amazon Macie). S3 Transfer Acceleration is unrelated to these requirements and is not necessary for this scenario.
- A. Correct.
Enabling SSE-KMS ensures that all data stored in the S3 bucket is encrypted using AWS Key Management Service, meeting the encryption requirement for sensitive data.
- B. Correct.
Using S3 bucket policies allows you to enforce strict access controls by specifying which IAM roles or accounts can access the bucket, aligning with the need to tightly control access.
- C. Incorrect.
S3 Transfer Acceleration improves upload speed but does not directly address encryption, access control, or auditing requirements for sensitive data.
- D. Correct.
Enabling S3 Access Logs or AWS CloudTrail logging ensures that all access to the S3 bucket is tracked and auditable, meeting the regulatory compliance requirement for monitoring access to sensitive data.
- E. Correct.
Amazon Macie helps discover and classify sensitive data automatically and provides insights into how it is being accessed, which is an essential tool for protecting sensitive data in compliance with regulations.