DOP-C02 Question 229
Select 2You are a DevOps Engineer responsible for ensuring that application logs and metrics in your AWS environment are encrypted both at rest and in transit. The logs are stored in Amazon S3, and you are using Amazon CloudWatch for metrics. Which combination of actions would ensure encryption for both logs and metrics?
- A
Enable server-side encryption with AWS KMS keys (SSE-KMS) for the S3 bucket storing the logs.
- B
Configure Amazon CloudWatch to use AWS Key Management Service (AWS KMS) for encrypting metrics at rest.
- C
Enable client-side encryption for logs before uploading them to the S3 bucket.
- D
Ensure that HTTPS is used when sending logs and metrics to their respective AWS services.
- E
Enable default encryption with Amazon S3-managed keys (SSE-S3) for the S3 bucket storing the logs.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure encryption for logs and metrics, you must address both at-rest and in-transit encryption. For logs stored in S3, server-side encryption with SSE-KMS provides robust at-rest encryption with AWS KMS-managed keys. For in-transit encryption, using HTTPS ensures secure communication when sending logs and metrics to AWS services. Other options, such as SSE-S3 or client-side encryption, either do not fulfill the requirements as effectively or are not necessary in this specific scenario.
- A. Correct.
Correct. Server-side encryption using AWS KMS keys (SSE-KMS) ensures that the logs stored in S3 are encrypted at rest using a customer-managed key provided by AWS KMS.
- B. Incorrect.
Incorrect. Amazon CloudWatch does not support direct integration with AWS KMS for encrypting metrics at rest. Metrics in CloudWatch are managed and encrypted automatically by AWS.
- C. Incorrect.
Incorrect. While client-side encryption is an option, it is not required in this scenario since server-side encryption (SSE-KMS) meets the requirement for encryption at rest.
- D. Correct.
Correct. HTTPS ensures encryption in transit when logs and metrics are sent to AWS services, such as S3 and CloudWatch.
- E. Incorrect.
Incorrect. While SSE-S3 provides server-side encryption, AWS KMS (SSE-KMS) offers stronger customer-managed encryption capabilities and is the more appropriate choice for compliance or sensitive data.