DVA-C02 Question 169
Select 2A developer is building an application that stores sensitive customer data in an Amazon S3 bucket. Compliance requirements mandate that the data be encrypted at rest and in transit. Which combination of actions should the developer implement to meet this requirement?
- A
Enable server-side encryption (SSE) using AWS Key Management Service (SSE-KMS) for the S3 bucket.
- B
Use an SSL/TLS connection when uploading and downloading data to and from the S3 bucket.
- C
Store the encryption keys in the application code for easier access.
- D
Use a client-side encryption library to encrypt the data before uploading it to the S3 bucket.
- E
Disable bucket versioning to minimize storage of sensitive data.
Show answer and explanation
Correct answers: A, B
Explanation
To comply with encryption requirements for data at rest and in transit, the developer must enable server-side encryption to protect data stored in the S3 bucket and use an SSL/TLS connection to secure the data while it is being transmitted. These practices align with AWS security best practices and ensure compliance with the stated requirements.
- A. Correct.
This is correct. Server-side encryption (SSE) with AWS KMS ensures that data at rest in S3 is encrypted using a managed key from AWS KMS.
- B. Correct.
This is correct. Using SSL/TLS ensures that data in transit between the application and the S3 bucket is encrypted.
- C. Incorrect.
This is incorrect. Storing encryption keys in the application code is insecure and violates best practices for key management.
- D. Incorrect.
This is incorrect. While client-side encryption can encrypt data before it is uploaded, it is not required if server-side encryption is already being used, and it adds unnecessary complexity.
- E. Incorrect.
This is incorrect. Disabling bucket versioning does not address encryption requirements and could reduce data recovery options in case of accidental overwrites or deletions.