DOP-C02 Question 228
Select 3You are managing an application that generates sensitive logs stored in Amazon S3. Compliance requirements mandate that the data must be encrypted at rest and in transit. Additionally, you want to use AWS-provided services to manage encryption keys and minimize operational overhead. Which of the following configurations will fulfill these requirements?
- A
Enable Server-Side Encryption with AWS Key Management Service (SSE-KMS) for the S3 bucket and use HTTPS for data transfer.
- B
Enable Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) for the S3 bucket and use HTTP for data transfer.
- C
Enable Server-Side Encryption with Customer-Provided Keys (SSE-C) for the S3 bucket and use HTTPS for data transfer.
- D
Use client-side encryption before uploading logs to S3 and enforce HTTPS for data transfer.
- E
Enable Server-Side Encryption with AWS Key Management Service (SSE-KMS) for the S3 bucket and use HTTP for data transfer.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the compliance requirements, logs must be encrypted both at rest and in transit. At rest, you can use server-side encryption options like SSE-KMS or SSE-C, or client-side encryption. For in-transit encryption, HTTPS is mandatory. Options 1, 3, and 4 meet these requirements, while options 2 and 5 fail to ensure encryption in transit due to the use of HTTP.
- A. Correct.
This option is correct because SSE-KMS encrypts data at rest using AWS KMS-managed keys, and HTTPS ensures encryption in transit. This configuration minimizes operational overhead as AWS manages the encryption keys.
- B. Incorrect.
This option is incorrect because HTTP does not encrypt data in transit, violating the compliance requirement for encryption in transit.
- C. Correct.
This option is correct because SSE-C encrypts data at rest using customer-provided keys, and HTTPS ensures encryption in transit. However, this approach requires the customer to manage the encryption keys.
- D. Correct.
This option is correct because client-side encryption encrypts data at rest before it is uploaded to S3, and HTTPS ensures encryption in transit. However, this option requires the customer to manage the encryption process and keys.
- E. Incorrect.
This option is incorrect because HTTP does not encrypt data in transit, violating the compliance requirement for encryption in transit.