DOP-C02 Question 390
Select 3Your organization has recently adopted a multi-account strategy in AWS, and you are responsible for ensuring that sensitive data stored in S3 buckets across all accounts is encrypted at rest and classified appropriately based on sensitivity. Additionally, you must ensure that encryption keys are centrally managed and access to sensitive data is tightly controlled. What combination of approaches should you implement to meet these requirements?
- A
Use AWS Key Management Service (KMS) with customer-managed keys and enforce bucket policies to require server-side encryption (SSE-KMS).
- B
Use S3 Object Lock to classify data and enforce retention periods based on sensitivity levels.
- C
Enable AWS Config rules to check whether S3 buckets have default encryption enabled and are compliant with defined data classification policies.
- D
Use Amazon Macie to automatically classify and protect sensitive data and integrate it with AWS KMS for encryption key management.
- E
Enable S3 cross-region replication to ensure data is encrypted across regions with different encryption keys.
Show answer and explanation
Correct answers: A, C, D
Explanation
To manage data in a multi-account AWS environment, you must address encryption, key management, and data classification. Using AWS KMS with customer-managed keys ensures centralized encryption key management, while enforcing SSE-KMS via bucket policies guarantees data is encrypted at rest. AWS Config rules help monitor compliance with encryption and classification policies. Additionally, Amazon Macie provides automated data classification and integrates with AWS KMS for encryption management. These approaches collectively fulfill the requirements for sensitive data management.
- A. Correct.
Correct. AWS KMS with customer-managed keys allows you to centrally manage encryption keys, while enforcing bucket policies for SSE-KMS ensures that all objects are encrypted at rest.
- B. Incorrect.
Incorrect. S3 Object Lock is primarily used for retention and compliance, not for data classification or enforcing encryption.
- C. Correct.
Correct. AWS Config rules can continuously monitor and evaluate whether S3 buckets have encryption enabled and adhere to classification policies, helping you maintain compliance across accounts.
- D. Correct.
Correct. Amazon Macie can automatically classify and protect sensitive data. It integrates with AWS KMS to ensure sensitive data is encrypted properly.
- E. Incorrect.
Incorrect. S3 cross-region replication is used for data redundancy across regions, but it does not inherently address centralized encryption key management or data classification.