SCS-C02 Question 126
Single answerAn organization is migrating its on-premises workload to AWS and wants to ensure that all sensitive data is encrypted at rest in compliance with regulatory requirements. The organization decides to use Amazon S3 for storing sensitive data. Which approach ensures that the sensitive data is encrypted at rest and provides the organization with full control over the encryption keys?
- A
Use Amazon S3 server-side encryption with Amazon S3-managed keys (SSE-S3).
- B
Use Amazon S3 server-side encryption with AWS Key Management Service (SSE-KMS) and create a CMK managed by the organization.
- C
Use Amazon S3 server-side encryption with customer-provided keys (SSE-C).
- D
Encrypt the data client-side before uploading it to Amazon S3 and manage the encryption keys on-premises.
Show answer and explanation
Correct answer: D
Explanation
The organization requires full control over the encryption keys for compliance with regulatory requirements. Encrypting the data client-side before uploading to Amazon S3 ensures that the keys are managed on-premises and are not shared with AWS. This approach provides the highest level of control over the encryption keys compared to other server-side encryption options where AWS manages or interacts with the keys.
- A. Incorrect.
SSE-S3 uses Amazon S3-managed keys, which do not give the organization control over the encryption keys. This does not meet the requirement for full control over encryption keys.
- B. Incorrect.
SSE-KMS with a customer-managed CMK gives the organization partial control over the encryption keys via AWS KMS, but AWS still manages the encryption and decryption process. This does not fully satisfy the requirement of complete control over the encryption keys.
- C. Incorrect.
SSE-C allows the organization to provide their own encryption keys to Amazon S3, which gives them control over key management. However, the encryption and decryption are still performed by S3, and the keys must be transmitted to AWS with each request. This provides less security compared to client-side encryption.
- D. Correct.
Encrypting the data client-side before uploading it to Amazon S3 ensures that only the organization has access to the encryption keys, as they are managed entirely on-premises. This approach provides full control over encryption keys and satisfies the requirement.