DVA-C02 Question 113
Select 3You are developing an application that stores sensitive customer data in an Amazon S3 bucket. To meet strict security compliance requirements, you need to ensure that the data is encrypted both at rest and in transit, and you want to restrict access to the bucket only to your application running on Amazon EC2 instances. Which combination of measures should you implement to meet these requirements?
- A
Use an S3 bucket policy to allow access only from the specific EC2 instance role.
- B
Enable Server-Side Encryption with S3-Managed Keys (SSE-S3) for the S3 bucket.
- C
Enable transfer acceleration for the S3 bucket to increase data transfer speed.
- D
Use HTTPS to encrypt data in transit between the application and the S3 bucket.
- E
Enable cross-region replication for the S3 bucket to improve durability.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure sensitive customer data in an Amazon S3 bucket, you must ensure encryption at rest, encryption in transit, and restricted access. Using an S3 bucket policy tied to the specific EC2 instance role restricts access, while SSE-S3 ensures encryption at rest. HTTPS ensures data is encrypted during transmission, satisfying the encryption in transit requirement. Transfer acceleration and cross-region replication, while useful for other purposes, do not address the security requirements in this scenario.
- A. Correct.
Correct. Using an S3 bucket policy to allow access only from the specific EC2 instance role ensures that only your intended EC2 instances can interact with the bucket. This is a key security measure to restrict access.
- B. Correct.
Correct. Enabling Server-Side Encryption with S3-Managed Keys (SSE-S3) ensures that data is encrypted at rest, meeting the requirement for securing sensitive data.
- C. Incorrect.
Incorrect. Transfer acceleration improves the speed of data transfers to and from the bucket but does not provide encryption or restrict access, so it does not meet the security requirements in this scenario.
- D. Correct.
Correct. Using HTTPS for data transfers ensures encryption in transit, meeting the requirement to secure data while it is being transmitted.
- E. Incorrect.
Incorrect. Cross-region replication is a durability and availability feature, not a security feature directly related to encryption or access control.