MLA-C01 Question 100
Select 4You are building a machine learning pipeline on AWS to process sensitive customer data. To comply with strict regulatory requirements, you need to ensure that the data is encrypted both at rest and in transit. Which of the following techniques should you use to meet these requirements?
- A
Use AWS Key Management Service (AWS KMS) to manage encryption keys for encrypting data at rest.
- B
Enable server-side encryption (SSE) with Amazon S3-managed keys (SSE-S3) for storing data in Amazon S3.
- C
Encrypt data in transit by using HTTPS and TLS with AWS API Gateway and other services.
- D
Rely solely on AWS Identity and Access Management (IAM) policies to control access to the data.
- E
Use client-side encryption where you encrypt the data before uploading to AWS.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To comply with regulatory requirements for encrypting sensitive data, it is critical to ensure that data is encrypted both at rest and in transit. AWS provides several tools and services, such as AWS KMS for key management, server-side encryption with SSE-S3 for S3 storage, and HTTPS/TLS for data in transit. Client-side encryption adds another layer of protection by encrypting data before it is uploaded to AWS. Relying solely on IAM policies does not fulfill the encryption requirement, as IAM is designed for access control rather than data encryption.
- A. Correct.
AWS KMS is a managed service that helps you create and control encryption keys for encrypting data at rest. This is a recommended approach to manage encryption keys for sensitive data.
- B. Correct.
Server-side encryption with Amazon S3-managed keys (SSE-S3) encrypts data at rest in Amazon S3. It is a simple and effective way to protect data stored in S3.
- C. Correct.
HTTPS and TLS ensure data is encrypted in transit when communicating between services or with external clients, which is essential for securing sensitive data.
- D. Incorrect.
While IAM policies are crucial for access control, they do not provide encryption capabilities. This option alone does not meet the encryption requirements.
- E. Correct.
Client-side encryption ensures data is encrypted before being uploaded to AWS, providing an additional layer of security. This is particularly useful for sensitive data.