DOP-C02 Question 227
Select 2Your organization uses Amazon CloudWatch Logs to monitor application performance and store log data for compliance purposes. You are asked to ensure that logs are encrypted both at-rest and in-transit. Additionally, the encryption keys must be managed using AWS Key Management Service (AWS KMS). Which of the following configurations would meet these requirements?
- A
Enable server-side encryption for CloudWatch Logs using a customer-managed AWS KMS key.
- B
Use TLS encryption for all log data sent to CloudWatch Logs.
- C
Configure client-side encryption for logs before sending them to CloudWatch Logs.
- D
Use the default AWS-managed key for server-side encryption in CloudWatch Logs.
- E
Disable encryption in-transit since CloudWatch Logs encrypts data at-rest by default.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements of encrypting logs both at-rest and in-transit while managing encryption keys using AWS KMS, you need to enable server-side encryption with a customer-managed AWS KMS key and use TLS encryption for in-transit log data. This ensures compliance and security for the log data during storage and transmission.
- A. Correct.
Correct: Enabling server-side encryption with a customer-managed AWS KMS key ensures that logs at-rest are encrypted and the keys are managed securely by the organization.
- B. Correct.
Correct: TLS encryption ensures that log data is encrypted in-transit while being sent to CloudWatch Logs.
- C. Incorrect.
Incorrect: Client-side encryption is not natively required by CloudWatch Logs since it supports server-side encryption with AWS KMS.
- D. Incorrect.
Incorrect: Using the default AWS-managed key would encrypt logs at-rest, but it does not provide the level of key management control required by the organization.
- E. Incorrect.
Incorrect: Disabling encryption in-transit violates the requirement to ensure logs are encrypted both at-rest and in-transit.