SAP-C02 Question 214
Select 3A financial services company is migrating its on-premises trading platform to AWS. The platform processes sensitive client financial data and must comply with strict regulatory requirements, including encryption of data at rest and in transit, as well as detailed auditing of all access to resources. Which combination of security controls should you implement to meet these requirements?
- A
Enable default encryption for all S3 buckets storing client financial data and use AWS Key Management Service (KMS) to manage encryption keys.
- B
Enable Amazon Macie to automatically detect sensitive financial information and generate alerts for unauthorized access.
- C
Use AWS CloudTrail to log all API activity and configure it to send logs to an encrypted S3 bucket.
- D
Use AWS Shield Advanced to protect against DDoS attacks targeting the trading platform.
- E
Enforce TLS for all data transmitted between the trading platform and clients.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet the regulatory requirements for a financial services platform, the solution must include encryption of data at rest (using S3 default encryption with KMS), detailed auditing of all access (using CloudTrail with logs stored securely), and encryption of data in transit (via TLS). These controls ensure compliance with encryption and auditing mandates. While services like Amazon Macie and AWS Shield Advanced are beneficial in specific scenarios, they do not directly address the given requirements.
- A. Correct.
Correct: Enabling default encryption for S3 buckets and managing keys with AWS KMS ensures data at rest is encrypted and key management complies with regulatory requirements.
- B. Incorrect.
Incorrect: While Macie provides data discovery and alerting for sensitive data, it does not fulfill requirements for encryption or access logging.
- C. Correct.
Correct: AWS CloudTrail provides detailed auditing of all API activity, and storing logs in an encrypted S3 bucket ensures both compliance and security requirements are met.
- D. Incorrect.
Incorrect: AWS Shield Advanced protects against DDoS attacks but does not address encryption or auditing requirements.
- E. Correct.
Correct: Enforcing TLS ensures that all data transmitted between clients and the trading platform is encrypted in transit, meeting compliance needs.