SAP-C02 Question 155
Select 4A financial services company is migrating its on-premises data analytics platform to AWS. The platform processes sensitive customer data, and the company must meet compliance requirements such as GDPR and PCI DSS. They want to implement a solution that ensures data encryption at rest and in transit, minimizes the risk of unauthorized access, and provides detailed auditing capabilities for compliance purposes. Which combination of services and features should the company use?
- A
AWS Key Management Service (KMS) for encryption at rest and AWS Certificate Manager (ACM) for encryption in transit
- B
Amazon Macie for sensitive data discovery and monitoring
- C
AWS CloudTrail with log file integrity validation for auditing API calls
- D
Amazon S3 with default bucket policies to restrict access
- E
AWS Secrets Manager to manage API keys and sensitive credentials
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To meet compliance requirements such as GDPR and PCI DSS, the company must implement encryption at rest and in transit, sensitive data discovery, auditing, and secure management of credentials. AWS KMS and ACM address encryption, Amazon Macie ensures sensitive data is monitored, AWS CloudTrail supports auditing, and Secrets Manager ensures secure handling of sensitive credentials. S3 bucket policies alone do not provide encryption or auditing capabilities, so they are insufficient in this case.
- A. Correct.
Correct: AWS KMS provides centralized key management for encrypting data at rest, while ACM simplifies the management of SSL/TLS certificates for encryption in transit.
- B. Correct.
Correct: Amazon Macie helps identify and monitor sensitive data in the environment, aligning with GDPR and PCI DSS requirements.
- C. Correct.
Correct: AWS CloudTrail ensures compliance by auditing API calls and log file integrity validation detects any tampering with logs.
- D. Incorrect.
Incorrect: While Amazon S3 bucket policies can restrict access, they do not provide encryption or auditing directly. Additional configurations would be needed for encryption and compliance.
- E. Correct.
Correct: AWS Secrets Manager securely manages sensitive information such as API keys, ensuring they are not hardcoded or exposed.