DVA-C02 Question 182
Single answerYou are developing an application that processes sensitive customer data and stores it in an Amazon S3 bucket. To meet compliance requirements, the data must be encrypted both at rest and during transit. The application handles encryption and decryption before uploading and after downloading the data from S3. Which type of encryption is being used in this scenario?
- A
Server-side encryption with Amazon S3-managed keys (SSE-S3)
- B
Server-side encryption with AWS Key Management Service (SSE-KMS)
- C
Server-side encryption with customer-provided keys (SSE-C)
- D
Client-side encryption
Show answer and explanation
Correct answer: D
Explanation
In this scenario, the application is handling the encryption and decryption process independently of Amazon S3, which is the key characteristic of client-side encryption. Server-side encryption, on the other hand, means that AWS handles the encryption and decryption process after the data is uploaded to and before it is downloaded from S3. The specific mention of the application encrypting and decrypting the data points directly to client-side encryption.
- A. Incorrect.
Incorrect. Server-side encryption with Amazon S3-managed keys (SSE-S3) means that Amazon S3 manages both the encryption and decryption process at the server level, not the client-side.
- B. Incorrect.
Incorrect. Server-side encryption with AWS KMS (SSE-KMS) uses AWS Key Management Service to manage keys, and encryption/decryption occurs on the server-side, not the client-side.
- C. Incorrect.
Incorrect. Server-side encryption with customer-provided keys (SSE-C) still involves encryption and decryption occurring on the server-side, with keys provided by the customer.
- D. Correct.
Correct. Client-side encryption means that the application (client) is responsible for encrypting the data before uploading it to S3 and decrypting it after downloading, which matches the scenario described.