DVA-C02 Question 161
Single answerA developer is building an application that stores sensitive customer data in an Amazon S3 bucket. The company requires that all data is encrypted at rest and wants to use AWS Key Management Service (AWS KMS) for managing encryption keys. Which configuration will meet these requirements?
- A
Use Amazon S3 Server-Side Encryption with AWS KMS (SSE-KMS) and specify a KMS key.
- B
Enable Amazon S3 default encryption using Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).
- C
Encrypt the data on the client-side using a customer-provided key before uploading it to the S3 bucket.
- D
Use Amazon S3 Server-Side Encryption with a customer-provided key (SSE-C).
Show answer and explanation
Correct answer: A
Explanation
To meet the requirement of encrypting data at rest using AWS services and managing encryption keys with AWS KMS, Amazon S3 Server-Side Encryption with AWS KMS (SSE-KMS) is the appropriate option. This configuration ensures that data is encrypted at rest and that the encryption keys are managed by AWS KMS, aligning with the company's security and compliance requirements.
- A. Correct.
This is correct. Amazon S3 Server-Side Encryption with AWS KMS (SSE-KMS) allows you to use AWS KMS to manage your encryption keys, meeting the requirement of using AWS services for encryption and ensuring data is encrypted at rest.
- B. Incorrect.
This is incorrect. While SSE-S3 provides server-side encryption, it uses Amazon S3-managed keys instead of AWS KMS, which does not fulfill the requirement to use AWS KMS for managing encryption keys.
- C. Incorrect.
This is incorrect. Encrypting data on the client-side using a customer-provided key does not utilize AWS KMS for managing encryption keys, so it does not meet the requirement.
- D. Incorrect.
This is incorrect. SSE-C uses a customer-provided key for encryption, which does not involve AWS KMS and therefore does not satisfy the requirement.