DVA-C02 Question 197
Select 3You are developing a serverless application that processes sensitive customer data, including personally identifiable information (PII) and protected health information (PHI). The processed data is stored in Amazon S3, and you need to ensure compliance with data protection regulations. What steps should you take to properly classify and protect this data within AWS services?
- A
Enable default encryption on the S3 bucket and configure server-side encryption using AWS Key Management Service (AWS KMS).
- B
Use Amazon Macie to automatically discover, classify, and protect sensitive data such as PII and PHI stored in the S3 bucket.
- C
Store the sensitive data in an Amazon RDS database instead of Amazon S3 to ensure automatic encryption is applied.
- D
Apply S3 bucket policies to restrict access to specific IAM roles and users that require access to the data.
- E
Create a CloudWatch Alarm to monitor access logs for the S3 bucket to detect unauthorized access.
Show answer and explanation
Correct answers: A, B, D
Explanation
To protect sensitive data such as PII and PHI in Amazon S3, you must implement encryption, data classification, and access control. Enabling server-side encryption with AWS KMS ensures data at rest is protected. Amazon Macie helps automatically discover and classify sensitive data stored in S3. S3 bucket policies provide granular access control for authorized users and roles. While monitoring access logs and using alternative storage solutions like Amazon RDS are useful, they do not fully address the requirements for classifying and protecting sensitive data in S3 as described in this scenario.
- A. Correct.
Correct. Enabling default encryption with AWS KMS ensures that all objects stored in the S3 bucket are encrypted at rest, which is critical for protecting sensitive data like PII and PHI.
- B. Correct.
Correct. Amazon Macie is specifically designed to discover and classify sensitive data, making it an essential tool for managing compliance and securing sensitive information.
- C. Incorrect.
Incorrect. While Amazon RDS supports encryption, this option does not address the scenario which explicitly states that the data is stored in Amazon S3.
- D. Correct.
Correct. S3 bucket policies are an effective way to implement access controls, ensuring that only authorized users and roles can access sensitive data.
- E. Incorrect.
Incorrect. While monitoring access logs is useful for identifying potential security issues, this alone does not classify or protect sensitive data as required by the scenario.