SAP-C02 Question 236
Select 3A financial services company must design a secure solution for encrypting sensitive customer data stored in Amazon S3 and ensure secure communication between their on-premises data center and AWS. Which combination of options will meet these requirements?
- A
Use AWS Key Management Service (AWS KMS) to manage Customer Master Keys (CMKs) and enable server-side encryption (SSE-KMS) for S3 objects.
- B
Implement client-side encryption for S3 objects using a custom encryption library and store encryption keys in the on-premises data center.
- C
Set up an AWS Direct Connect connection and enable encryption using MACsec to secure the link.
- D
Configure an S3 bucket policy to deny unencrypted uploads and require HTTPS connections for data transfers.
- E
Use AWS VPN with IPsec to establish a secure encrypted connection between the on-premises data center and AWS.
Show answer and explanation
Correct answers: A, D, E
Explanation
To meet the requirements of encrypting sensitive customer data at rest in S3 and ensuring secure communication between the on-premises data center and AWS, you can use AWS KMS with SSE-KMS for encrypting S3 data, enforce HTTPS for S3 bucket interactions, and establish an AWS VPN connection using IPsec for secure data transit. These options collectively ensure both data at rest and data in transit are secured.
- A. Correct.
AWS Key Management Service (AWS KMS) with server-side encryption (SSE-KMS) is a highly secure and scalable option for encrypting data at rest in Amazon S3. It allows AWS to manage encryption keys while giving the customer control over usage policies.
- B. Incorrect.
Client-side encryption is not necessary in this case since AWS KMS and SSE-KMS provide sufficient encryption for data at rest. Additionally, managing custom encryption libraries and storing keys on-premises might introduce operational overhead and complexity.
- C. Incorrect.
While AWS Direct Connect provides a private link to AWS, encryption using MACsec is only available under specific conditions and is not the most common or straightforward method for securing communications. This option is not essential for the scenario.
- D. Correct.
Requiring HTTPS connections ensures that data in transit to and from the S3 bucket is encrypted, and denying unencrypted uploads enforces encryption compliance for stored data.
- E. Correct.
Using AWS VPN with IPsec is a standard and secure method for encrypting data in transit between the on-premises data center and AWS, ensuring confidentiality and integrity.