SAP-C02 Question 406
Single answerA financial company needs to design a data storage solution for its credit card transactions. The solution must meet the following requirements:
- Comply with PCI DSS (Payment Card Industry Data Security Standard) requirements.
- Retain transaction records for 7 years due to regulatory compliance.
- Ensure data is encrypted at rest and in transit.
- Minimize costs while meeting these requirements.
Which solution should the company implement?
- A
Store the transaction data in Amazon S3 with default encryption enabled, and configure S3 Object Lock to enforce retention policies.
- B
Use Amazon RDS for MySQL with encryption enabled, and enable automated backups for 7 years.
- C
Store the transaction data in Amazon S3 Glacier Deep Archive with a custom bucket policy to enforce encryption and data retention for 7 years.
- D
Use Amazon DynamoDB for storing transaction data with server-side encryption enabled, and configure TTL (Time to Live) for 7 years.
Show answer and explanation
Correct answer: A
Explanation
Amazon S3 with default encryption and S3 Object Lock is the best solution because it meets PCI DSS compliance requirements, enforces a 7-year retention policy, and minimizes costs. S3 Object Lock ensures the data is immutable during the retention period, and default encryption ensures the data is protected at rest and in transit. Other options either fail to meet compliance needs or are not cost-effective for long-term data retention.
- A. Correct.
This option is correct. Amazon S3 with default encryption and S3 Object Lock can meet PCI DSS requirements, enforce a 7-year retention policy, and provide a cost-effective solution for storing large volumes of data. S3 Object Lock ensures data cannot be deleted or modified during the retention period.
- B. Incorrect.
Amazon RDS can support encryption and backups, but it is not the most cost-effective solution for long-term storage of transaction data. Additionally, managing and retaining backups for 7 years can become operationally complex.
- C. Incorrect.
Amazon S3 Glacier Deep Archive supports low-cost long-term storage, but it is not well-suited for PCI DSS compliance due to lack of native real-time data access and integration with S3 Object Lock for regulatory enforcement.
- D. Incorrect.
Amazon DynamoDB with server-side encryption can store sensitive data, but it is not designed for long-term retention of historical transaction records. TTL is also not appropriate for regulatory retention requirements as it automatically deletes data after the specified time.