SAP-C02 Question 233
Select 2A company is designing a secure data storage and transmission solution for sensitive customer information. The data must be encrypted at rest and in transit to meet compliance requirements. The company uses Amazon S3 for storage and Amazon API Gateway for handling data transfer to backend services. What are the MOST appropriate AWS services or configurations to meet these requirements?
- A
Enable Amazon S3 Server-Side Encryption (SSE) with AWS Key Management Service (SSE-KMS).
- B
Use Amazon S3 client-side encryption with a custom encryption library.
- C
Configure TLS for API Gateway endpoints to encrypt data in transit.
- D
Enable Amazon S3 Server-Side Encryption using SSE-S3 (managed by AWS).
- E
Use AWS Direct Connect without encryption, as it is a dedicated private connection.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the encryption requirements for data at rest and in transit, Amazon S3 SSE-KMS enables secure storage using AWS-managed or customer-managed keys, and configuring TLS for API Gateway ensures data is encrypted during transmission. These options provide the most appropriate and secure solutions for the given scenario while adhering to compliance requirements.
- A. Correct.
Correct: Amazon S3 SSE-KMS provides secure encryption at rest using AWS Key Management Service, ensuring compliance with encryption standards.
- B. Incorrect.
Incorrect: While client-side encryption is an option, managing custom encryption libraries increases complexity and is not the most appropriate solution if AWS-provided server-side encryption is available.
- C. Correct.
Correct: Configuring TLS for API Gateway endpoints ensures that data is encrypted in transit, meeting compliance requirements for secure transmission.
- D. Incorrect.
Incorrect: While SSE-S3 encrypts data at rest, it does not use customer-managed keys and may not satisfy compliance requirements requiring explicit key management.
- E. Incorrect.
Incorrect: AWS Direct Connect provides a private connection but does not include built-in encryption. Data in transit would remain unencrypted unless additional measures like TLS are implemented.