DVA-C02 Question 199
Select 4You are developing a healthcare application on AWS that stores and processes patient data, including personally identifiable information (PII) and protected health information (PHI). Which actions should you take to ensure compliance with data protection regulations and secure sensitive data?
- A
Enable server-side encryption for all S3 buckets storing patient data.
- B
Use Amazon Macie to classify and monitor sensitive data stored in S3.
- C
Allow unrestricted public access to S3 buckets containing PII and PHI to improve application performance.
- D
Ensure data transmission is encrypted by using HTTPS and AWS Key Management Service (KMS) for encryption keys.
- E
Store sensitive data in Amazon RDS with encryption enabled at rest and configure database auditing.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To handle PII and PHI securely on AWS, you should implement encryption both at rest and in transit, use tools like Amazon Macie for data classification, and ensure access control and auditing are in place. Avoid practices like making sensitive data publicly accessible, as this exposes you to significant security risks and compliance violations.
- A. Correct.
Correct: Enabling server-side encryption on S3 ensures that stored data is encrypted at rest, which is a critical measure for protecting sensitive information like PII and PHI.
- B. Correct.
Correct: Amazon Macie helps identify and classify sensitive data, such as PII and PHI, in S3 buckets. This is essential for monitoring and compliance.
- C. Incorrect.
Incorrect: Allowing unrestricted public access to S3 buckets violates security best practices and exposes sensitive data, such as PII and PHI, to unauthorized access.
- D. Correct.
Correct: Encrypting data in transit using HTTPS and securing encryption keys with AWS KMS are vital steps to protect sensitive information during transmission.
- E. Correct.
Correct: Enabling encryption at rest for Amazon RDS and configuring auditing ensures that sensitive data is stored securely and access is properly logged for compliance.