MLA-C01 Question 104
Select 3You are building a machine learning pipeline on AWS that processes sensitive customer data. To ensure data security, you need to encrypt the data stored in Amazon S3 and while it is being transmitted between services. Which techniques should you use to meet these requirements?
- A
Use AWS Key Management Service (KMS) to manage encryption keys for server-side encryption in S3.
- B
Enable client-side encryption using a custom key stored in your on-premises environment.
- C
Enable Amazon S3 default encryption with AES-256 encryption algorithm.
- D
Use HTTPS to encrypt data in transit between services.
- E
Enable S3 Transfer Acceleration for secure data transfer.
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure sensitive data in both storage and transit, you need to implement encryption techniques. AWS KMS can manage server-side encryption keys for S3, and enabling default encryption with AES-256 ensures data at rest is secure. Additionally, HTTPS should be used to encrypt data in transit. While other options like client-side encryption or S3 Transfer Acceleration may provide some benefits, they are either unnecessary in this scenario or do not directly address encryption needs.
- A. Correct.
Correct: AWS KMS integrates with S3 to provide server-side encryption with customer-managed keys, ensuring that data at rest is encrypted securely.
- B. Incorrect.
Partially correct but not ideal: While client-side encryption is valid, managing custom keys on-premises increases complexity and risk. AWS services offer integrated encryption options that are easier to manage.
- C. Correct.
Correct: Enabling default encryption with AES-256 ensures that all objects stored in S3 are encrypted at rest using a strong algorithm.
- D. Correct.
Correct: HTTPS encrypts data in transit, ensuring that sensitive data is protected during transmission between services.
- E. Incorrect.
Incorrect: S3 Transfer Acceleration is designed to speed up data transfers globally using optimized network paths, but it does not provide encryption.