SAP-C02 Question 446
Select 3A company is migrating its on-premises data analytics platform to AWS. The platform processes sensitive customer data, and the company must comply with strict regulatory requirements, including encryption of data at rest and in transit. The company wants to minimize the operational overhead of managing encryption keys while ensuring full control over them. Which combination of AWS services and features should the company use to meet these requirements?
- A
Use AWS Key Management Service (KMS) with customer-managed keys (CMKs) to encrypt data at rest.
- B
Enable AWS CloudHSM to store and manage encryption keys for full control.
- C
Use Amazon S3 with default encryption enabled and AWS-managed keys.
- D
Configure AWS Certificate Manager (ACM) to manage SSL/TLS certificates for encrypting data in transit.
- E
Use AWS Secrets Manager to store and retrieve encryption keys for the platform.
Show answer and explanation
Correct answers: A, B, D
Explanation
The company requires encryption of data both at rest and in transit, with full control over encryption keys to meet regulatory requirements. AWS KMS with customer-managed keys and AWS CloudHSM address the need for controlling encryption keys while minimizing operational overhead. ACM ensures secure encryption of data in transit. Using S3 with AWS-managed keys or Secrets Manager does not meet the requirement for full control over encryption keys.
- A. Correct.
Correct: AWS KMS with customer-managed keys (CMKs) allows the company to encrypt data at rest while maintaining full control over the encryption keys. This meets the requirement for regulatory compliance and minimal operational overhead.
- B. Correct.
Correct: AWS CloudHSM provides dedicated hardware security modules, allowing the company to manage encryption keys with full control. This is ideal for compliance with strict regulatory requirements.
- C. Incorrect.
Incorrect: While Amazon S3 with default encryption and AWS-managed keys offers encryption at rest, it does not provide the company full control over the keys, which is a requirement in this scenario.
- D. Correct.
Correct: AWS Certificate Manager (ACM) simplifies the management of SSL/TLS certificates to encrypt data in transit, ensuring compliance with regulatory requirements for secure data transmission.
- E. Incorrect.
Incorrect: AWS Secrets Manager is used for managing secrets such as database credentials, API keys, or passwords, but it is not suitable for managing encryption keys for this specific use case.