MLS-C01 Question 292
Select 3You are designing a machine learning workflow on AWS to train a model using sensitive customer data. Following AWS best practices for security, how should you configure your Amazon S3 bucket, which will store the dataset, to ensure data protection?
- A
Enable server-side encryption with AWS Key Management Service (AWS KMS) keys.
- B
Make the S3 bucket publicly accessible to allow anyone to access the training data.
- C
Enable S3 bucket logging and monitor access using AWS CloudTrail.
- D
Use an S3 bucket policy to restrict access to specific IAM roles.
- E
Disable versioning on the S3 bucket to reduce storage costs.
Show answer and explanation
Correct answers: A, C, D
Explanation
To protect sensitive data in an S3 bucket, you should follow AWS security best practices, such as enabling server-side encryption, restricting access using bucket policies, and monitoring access with logging tools like AWS CloudTrail. Avoid making the bucket publicly accessible and disabling features like versioning that provide additional data protection.
- A. Correct.
Correct. Enabling server-side encryption with AWS KMS protects data at rest and is an AWS best practice for securing sensitive data.
- B. Incorrect.
Incorrect. Making the S3 bucket publicly accessible is a security risk and violates AWS best practices for handling sensitive information.
- C. Correct.
Correct. Enabling S3 bucket logging and monitoring access with AWS CloudTrail provides visibility into access patterns and ensures compliance with security policies.
- D. Correct.
Correct. Using an S3 bucket policy to restrict access to specific IAM roles ensures that only authorized entities can access the sensitive data, aligning with AWS security best practices.
- E. Incorrect.
Incorrect. Disabling versioning is not recommended when managing sensitive data, as versioning helps protect against accidental deletion or overwriting of data.