DOP-C02 Question 372
Select 3Your organization handles sensitive customer data and has compliance requirements that mandate encryption of all data at rest and in transit. To enforce this, you need to automate security controls for S3 buckets and ensure data protection. Which steps should you implement to meet these requirements?
- A
Enable default encryption on all S3 buckets using an AWS Key Management Service (KMS) key.
- B
Use an Amazon S3 bucket policy to enforce TLS (HTTPS) for all data uploads and downloads.
- C
Implement Server Access Logging on the S3 bucket to monitor access patterns.
- D
Create an AWS Config rule to check if S3 buckets have default encryption enabled and notify via Amazon SNS if non-compliance is detected.
- E
Use S3 Transfer Acceleration to improve performance for uploads and downloads of sensitive data.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet compliance requirements for encrypting data at rest and in transit, you must enable default encryption on S3 buckets and enforce TLS for data transmissions. Automating compliance checks with AWS Config rules ensures violations are detected and addressed. Server Access Logging and S3 Transfer Acceleration, while useful for other purposes, do not enforce or automate security controls for encryption.
- A. Correct.
Correct. Enabling default encryption ensures that all objects stored in the S3 bucket are automatically encrypted, meeting the data-at-rest encryption requirement.
- B. Correct.
Correct. Enforcing TLS (HTTPS) ensures that data in transit is encrypted, fulfilling the data protection compliance requirement.
- C. Incorrect.
Incorrect. While Server Access Logging provides visibility into bucket access, it does not enforce encryption or data protection.
- D. Correct.
Correct. AWS Config rules can be used to automate compliance checks for S3 bucket encryption and can notify administrators of violations, ensuring continuous compliance.
- E. Incorrect.
Incorrect. S3 Transfer Acceleration improves upload/download performance but does not address encryption or data protection requirements.