DOP-C02 Question 387
Select 2Your organization stores sensitive customer data in Amazon S3. You need to ensure that all data is encrypted both at rest and in transit, and that encryption keys are managed securely while complying with your company's strict security policies. Which combination of steps should you take to achieve this?
- A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) for S3 buckets.
- B
Use AWS PrivateLink to access S3 over a private network instead of the public internet.
- C
Enforce the use of HTTPS for all data transfers to and from S3 by configuring a bucket policy.
- D
Use client-side encryption and store the encryption keys in a custom key management system hosted on-premises.
- E
Enable S3 bucket versioning to ensure historical versions of data are retained.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirements for encrypting data both at rest and in transit, enabling SSE-KMS secures data at rest using managed keys, while enforcing HTTPS ensures that data is encrypted during transfer. These approaches align with AWS best practices for security and key management. The other options either do not directly address the encryption requirements or introduce unnecessary complexity.
- A. Correct.
This ensures that data is encrypted at rest using keys managed by AWS KMS, which provides greater control and auditing capabilities.
- B. Incorrect.
While AWS PrivateLink enhances network security by avoiding the public internet, it does not directly address encryption requirements for data in transit or at rest.
- C. Correct.
Enforcing HTTPS ensures that data is encrypted in transit, meeting the requirement for secure data transfer.
- D. Incorrect.
Using client-side encryption can meet the encryption requirement, but relying on a custom on-premises key management system introduces operational complexity and may not align with AWS best practices for secure key management.
- E. Incorrect.
S3 bucket versioning helps with data recovery and auditing but is unrelated to encryption or key management.