SAP-C02 Question 405
Select 2A financial services company needs to store customer transaction data for 10 years to comply with regulatory requirements. The data is highly sensitive and must be encrypted at rest and in transit. Additionally, the company must ensure that the data is immutable and cannot be deleted or modified during the retention period. Which combination of AWS services and features should be used to meet these requirements?
- A
Use Amazon S3 with Object Lock in Compliance mode, SSE-S3 for encryption at rest, and enforce SSL for encryption in transit.
- B
Use Amazon S3 Glacier with Object Lock in Governance mode, SSE-KMS for encryption at rest, and enforce TLS for encryption in transit.
- C
Use AWS Backup with lifecycle policies to archive data to Amazon S3 Glacier Deep Archive and enable encryption using SSE-KMS.
- D
Use Amazon S3 with Object Lock in Compliance mode, SSE-KMS for encryption at rest, and enforce TLS for encryption in transit.
- E
Use Amazon EFS with encryption enabled and configure lifecycle policies to meet retention requirements.
Show answer and explanation
Correct answers: A, D
Explanation
To meet the strict regulatory requirements, the data must be stored immutably and encrypted at rest and in transit. Amazon S3 with Object Lock in Compliance mode ensures that the data cannot be deleted or modified during the retention period. For encryption at rest, both SSE-S3 and SSE-KMS are valid options, but SSE-KMS provides more control over the encryption keys. Additionally, enforcing SSL/TLS for data in transit ensures compliance with encryption requirements. Other options either lack proper immutability or are not designed for long-term retention and compliance.
- A. Correct.
Correct: Amazon S3 with Object Lock in Compliance mode ensures data immutability, while SSE-S3 provides server-side encryption at rest, and SSL enforces encryption in transit.
- B. Incorrect.
Incorrect: Governance mode of Object Lock allows authorized users to bypass the lock, which does not meet strict immutability requirements for regulatory compliance.
- C. Incorrect.
Incorrect: AWS Backup does not inherently provide immutability or the full set of compliance features required. It is better suited for backup and recovery use cases.
- D. Correct.
Correct: Amazon S3 with Object Lock in Compliance mode ensures data immutability, while SSE-KMS provides enhanced encryption at rest with customer-managed keys, and TLS ensures encryption in transit.
- E. Incorrect.
Incorrect: Amazon EFS is not designed for long-term archival storage with immutability and does not meet the regulatory compliance requirements for this scenario.