MLA-C01 Question 103
Select 3You are tasked with designing a machine learning workflow on AWS that processes sensitive user data. To meet security requirements, you must encrypt the data at rest and in transit. Which techniques should you use to ensure compliance with AWS best practices for data encryption?
- A
Use AWS Key Management Service (KMS) to manage encryption keys for encrypting data at rest.
- B
Enable SSL/TLS for encrypting data in transit between services.
- C
Store encryption keys in Amazon S3 for easy access during the workflow.
- D
Use client-side encryption to encrypt data before uploading it to Amazon S3.
- E
Rely solely on IAM roles and policies for securing sensitive data.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure compliance with AWS best practices for encrypting sensitive data, you should use AWS KMS for managing encryption keys for data at rest, enable SSL/TLS for encrypting data in transit, and optionally use client-side encryption for added security. Storing encryption keys in Amazon S3 is not recommended due to potential security risks, and IAM roles and policies focus on access control rather than encryption.
- A. Correct.
Correct. AWS KMS is the recommended service for managing encryption keys, and it integrates seamlessly with other AWS services for encrypting data at rest.
- B. Correct.
Correct. SSL/TLS is the standard technique for encrypting data in transit, ensuring secure communication between services.
- C. Incorrect.
Incorrect. Storing encryption keys in Amazon S3 is not a secure practice unless combined with proper encryption and access controls. AWS KMS is a more secure and recommended approach.
- D. Correct.
Correct. Client-side encryption ensures that data is encrypted before being sent to AWS services, adding an additional layer of security.
- E. Incorrect.
Incorrect. IAM roles and policies are crucial for access control but do not provide encryption for data at rest or in transit.