DVA-C02 Question 198
Select 4You are developing an application that processes sensitive user data, including personally identifiable information (PII) and protected health information (PHI). The application stores this data in Amazon S3. Which of the following steps should you take to ensure compliance with data protection and classification requirements?
- A
Enable server-side encryption (SSE) on the S3 bucket.
- B
Apply an S3 bucket policy that denies public access to the bucket.
- C
Use Amazon Macie to classify and monitor the sensitive data stored in the bucket.
- D
Store the sensitive data in plain text in the S3 bucket for easier debugging and development purposes.
- E
Configure AWS Key Management Service (KMS) to manage encryption keys for the data.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To ensure compliance with data protection requirements when storing sensitive information like PII or PHI, you should use encryption mechanisms like SSE and KMS, restrict public access to data using bucket policies, and utilize tools like Amazon Macie for automated data classification and monitoring. Storing sensitive data in plain text is a security risk and should be avoided.
- A. Correct.
Correct: Enabling server-side encryption (SSE) ensures that data at rest is encrypted, helping to protect sensitive information like PII and PHI.
- B. Correct.
Correct: Applying a bucket policy that denies public access prevents unauthorized access to the sensitive data stored in the S3 bucket.
- C. Correct.
Correct: Amazon Macie provides automated data classification and monitoring, which is essential for identifying and protecting sensitive data like PII and PHI.
- D. Incorrect.
Incorrect: Storing sensitive data in plain text exposes it to potential breaches and is a violation of best practices for handling PII and PHI.
- E. Correct.
Correct: Using AWS Key Management Service (KMS) to manage encryption keys ensures proper key rotation and access control, which is critical for securing sensitive data.