SAP-C02 Question 425
Select 2A financial services company needs to ensure that sensitive customer data stored in Amazon S3 is protected from unauthorized access and that all access requests are logged for audit purposes. The company also wants to ensure that the encryption keys used for protecting the data are rotated automatically. Which combination of AWS services and features should the company use to meet these requirements?
- A
Enable server-side encryption with AWS Key Management Service (KMS) keys (SSE-KMS) on the S3 bucket.
- B
Enable S3 bucket logging to capture access requests.
- C
Enable AWS CloudTrail logs to monitor API activity related to the S3 bucket.
- D
Use Amazon Macie to automatically encrypt the data in the S3 bucket.
- E
Enable default encryption with S3-managed keys (SSE-S3).
Show answer and explanation
Correct answers: A, C
Explanation
To meet the company's requirements for protecting sensitive data, ensuring key rotation, and logging access requests, enabling SSE-KMS on the S3 bucket is the best choice for encryption, as it provides automatic key rotation and fine-grained access control. Additionally, enabling AWS CloudTrail logs ensures that all API activity related to the S3 bucket is logged for auditing purposes. S3 bucket logging, SSE-S3, and Amazon Macie do not fully address the requirements in this scenario.
- A. Correct.
Correct. Using SSE-KMS ensures that data in the S3 bucket is encrypted, and AWS KMS automatically handles key rotation.
- B. Incorrect.
Incorrect. S3 bucket logging captures detailed access logs, but it does not provide the level of auditing required for monitoring API activity or logging sensitive data access.
- C. Correct.
Correct. AWS CloudTrail logs API activity for S3, which is essential for auditing and monitoring access requests to sensitive data.
- D. Incorrect.
Incorrect. While Amazon Macie is a useful tool for identifying sensitive data in S3, it does not handle encryption or key rotation.
- E. Incorrect.
Incorrect. SSE-S3 encrypts data using S3-managed keys, but it does not provide the automatic key rotation and access control features that SSE-KMS offers.