DOP-C02 Question 388
Select 3A company is migrating sensitive financial data to AWS and is required to comply with strict regulatory standards. The data must be encrypted at rest and in transit, and the encryption keys must be rotated automatically. Additionally, access to the data must be limited to certain IAM roles and logged for auditing purposes. Which combination of AWS services and configurations should the company use to meet these requirements?
- A
Use AWS Key Management Service (KMS) to manage encryption keys with automatic rotation enabled.
- B
Configure Amazon S3 with server-side encryption using an S3-managed key (SSE-S3) for data at rest.
- C
Enable Amazon S3 server access logging to monitor access to the data.
- D
Use AWS Certificate Manager (ACM) to handle encryption for data stored in Amazon S3.
- E
Use AWS IAM policies to restrict access to specific roles and enable AWS CloudTrail to log all access activity.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet the compliance requirements, the company needs a solution that provides encryption at rest and in transit, automatic key rotation, access control, and logging. AWS KMS fulfills the key management and rotation requirement, while S3 server access logging and CloudTrail ensure access monitoring for auditing. IAM policies restrict access to specific roles, addressing access control needs. SSE-S3 does not meet the key rotation requirement, and ACM is irrelevant for encrypting data stored in S3.
- A. Correct.
Correct: AWS Key Management Service (KMS) allows you to manage encryption keys, including enabling automatic key rotation, which is required for compliance.
- B. Incorrect.
Incorrect: While SSE-S3 provides encryption at rest, it doesn't allow for customer-managed key rotation, which is a compliance requirement in this scenario.
- C. Correct.
Correct: Enabling Amazon S3 server access logging provides detailed records of requests made to the bucket, which is critical for auditing purposes.
- D. Incorrect.
Incorrect: AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates and is not applicable for encrypting data at rest in S3.
- E. Correct.
Correct: AWS IAM policies can restrict access to specific roles, and AWS CloudTrail provides comprehensive logging of access activities, fulfilling the access control and auditing requirements.