DVA-C02 Question 183
Single answerA developer is building a secure file upload application that stores sensitive data in Amazon S3. The application must ensure that data is encrypted before it leaves the user's device, and only authorized users can decrypt it. Which encryption method should the developer choose to meet this requirement?
- A
Server-side encryption with S3-managed keys (SSE-S3)
- B
Server-side encryption with customer-provided keys (SSE-C)
- C
Server-side encryption with AWS Key Management Service (SSE-KMS)
- D
Client-side encryption
Show answer and explanation
Correct answer: D
Explanation
Client-side encryption is the appropriate choice when you need to ensure that data is encrypted before it leaves the user's device and can only be decrypted by authorized users. In this scenario, server-side encryption methods (SSE-S3, SSE-C, SSE-KMS) encrypt data after it has been uploaded to Amazon S3, which does not meet the requirement for pre-upload encryption.
- A. Incorrect.
SSE-S3 encrypts data at rest in S3 using Amazon-managed keys, but the data is not encrypted before leaving the user's device.
- B. Incorrect.
SSE-C allows the customer to provide their own encryption keys for server-side encryption, but the encryption and decryption occur on the server, not on the client device.
- C. Incorrect.
SSE-KMS uses AWS Key Management Service for key management, but the encryption is still performed on the server side after the data is uploaded.
- D. Correct.
Client-side encryption ensures that data is encrypted on the client device before being uploaded to Amazon S3, meeting the requirement for encryption before leaving the user's device.