SAP-C02 Question 408
Select 2Your organization operates in the financial industry and needs to adhere to stringent regulatory requirements, such as GDPR and PCI DSS. You are tasked with designing a data storage solution for customer transaction data that must retain records for 7 years, ensure encryption at rest and in transit, and provide detailed auditing capabilities. Which combination of AWS services and configurations will best meet these requirements?
- A
Use Amazon S3 with Object Lock in Compliance mode to enforce retention policies, enable server-side encryption with AWS KMS, and configure bucket logging for audit trails.
- B
Store the data in Amazon RDS using Multi-AZ deployment, enable Transparent Data Encryption (TDE), and use AWS CloudTrail for database access auditing.
- C
Use Amazon DynamoDB with DynamoDB Streams for auditing, enable encryption at rest, and configure IAM policies to enforce least privilege access.
- D
Store the data in Amazon S3 Glacier Deep Archive with a lifecycle policy for deletion after 7 years, enable encryption at rest using S3-managed keys, and use Amazon CloudWatch Logs for auditing.
- E
Use Amazon EBS volumes with encryption enabled, take regular snapshots stored in Amazon S3, and enable Amazon Macie for sensitive data discovery.
Show answer and explanation
Correct answers: A, B
Explanation
To meet stringent data retention and regulatory requirements like GDPR and PCI DSS, you need services that provide enforced retention policies, encryption at rest and in transit, and detailed auditing capabilities. Amazon S3 with Object Lock in Compliance mode and server-side encryption meets these needs for object storage, while Amazon RDS with Multi-AZ deployment, Transparent Data Encryption (TDE), and CloudTrail auditing ensures compliance for relational data. Other options lack required features such as enforced retention policies or detailed auditing, making them unsuitable for this scenario.
- A. Correct.
This option is correct because Amazon S3 with Object Lock in Compliance mode can enforce retention policies to meet regulatory requirements like GDPR. Server-side encryption with AWS KMS ensures data is encrypted at rest, and bucket logging provides audit capabilities.
- B. Correct.
This option is correct because Amazon RDS with Multi-AZ deployment ensures high availability while Transparent Data Encryption (TDE) encrypts data at rest. AWS CloudTrail provides the detailed auditing needed for compliance with regulations like PCI DSS.
- C. Incorrect.
This option is incorrect because while DynamoDB encryption at rest and Streams provide certain capabilities, it lacks the granular retention capabilities and compliance-specific controls required for GDPR or PCI DSS. It's better suited for real-time applications rather than long-term storage.
- D. Incorrect.
This option is incorrect because Amazon S3 Glacier Deep Archive with lifecycle policies is suitable for long-term storage but does not enforce retention policies in a way that meets compliance standards. Additionally, encryption using S3-managed keys does not meet the regulatory requirements for key management.
- E. Incorrect.
This option is incorrect because while Amazon EBS provides encryption and snapshots, it does not inherently enforce retention policies or provide detailed auditing capabilities. Amazon Macie is useful for sensitive data discovery but does not address long-term retention or compliance requirements.