DVA-C02 Question 200
Select 3Your application stores customer data in Amazon S3 and processes it using AWS Lambda. The data includes sensitive information such as personally identifiable information (PII) and protected health information (PHI). To ensure compliance with privacy regulations, which steps should you take to secure this data?
- A
Enable server-side encryption for the S3 bucket using AWS Key Management Service (KMS).
- B
Use S3 bucket policies to restrict access to only specific IAM roles or users.
- C
Enable versioning on the S3 bucket to track changes to sensitive data.
- D
Implement a Lambda function to encrypt data before storing it in S3.
- E
Tag the S3 bucket with metadata indicating it contains sensitive data.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure sensitive data such as PII or PHI and comply with privacy regulations, you should use encryption both at rest and in transit, restrict access to authorized users, and implement additional measures such as encrypting data before storage. Server-side encryption with AWS KMS and IAM-based access control are AWS best practices for protecting sensitive data. While tagging and versioning are helpful for management and auditing purposes, they do not directly secure the data.
- A. Correct.
Correct. Enabling server-side encryption with AWS KMS ensures that the data is encrypted at rest and provides control over the encryption keys, which is essential for handling PII or PHI.
- B. Correct.
Correct. Restricting access to specific IAM roles or users ensures that only authorized entities can access the sensitive data, which is a fundamental security practice.
- C. Incorrect.
Incorrect. While versioning is useful for tracking changes and recovering data, it does not directly help to secure sensitive data or ensure compliance with privacy regulations.
- D. Correct.
Correct. Encrypting the data before storing it in S3 adds an extra layer of security, ensuring that even if unauthorized access occurs, the data cannot be read without the decryption key.
- E. Incorrect.
Incorrect. Adding metadata tags indicating sensitive data is useful for organizational purposes but does not directly secure the data or ensure compliance with privacy regulations.