DVA-C02 Question 181
Single answerAn AWS developer is designing a secure file upload system for an S3 bucket. The system must ensure that the files are encrypted and only accessible to authorized users. The developer needs to decide between client-side encryption and server-side encryption. Which of the following statements is true about the differences between these two encryption methods?
- A
Client-side encryption requires the developer to manage encryption keys, while server-side encryption has AWS manage the encryption keys by default.
- B
Server-side encryption encrypts data before it leaves the client, while client-side encryption encrypts the data only after it reaches the AWS server.
- C
Client-side encryption is mandatory for enabling encryption at rest in Amazon S3, while server-side encryption is optional.
- D
Both client-side encryption and server-side encryption require the use of AWS Key Management Service (AWS KMS).
Show answer and explanation
Correct answer: A
Explanation
Client-side encryption differs from server-side encryption primarily in where the encryption occurs and who manages the encryption keys. In client-side encryption, encryption and key management are handled by the client. In server-side encryption, AWS handles the encryption process and key management by default, providing a simpler implementation for developers.
- A. Correct.
Correct: In client-side encryption, the developer manages encryption keys and encrypts data before sending it to AWS. For server-side encryption, AWS manages the encryption keys by default unless custom keys are used.
- B. Incorrect.
Incorrect: Server-side encryption encrypts data after it reaches AWS servers, not before leaving the client. Client-side encryption encrypts data before sending it to AWS.
- C. Incorrect.
Incorrect: Server-side encryption can be used to enable encryption at rest in Amazon S3, and it is not mandatory to use client-side encryption for this purpose.
- D. Incorrect.
Incorrect: While AWS KMS can be used for both methods, it is not a requirement for either client-side or server-side encryption. Other key management options exist.