SCS-C02 Question 145
Single answerYour company runs a web application that stores sensitive customer data in Amazon S3. Compliance requirements mandate that all data must be encrypted at rest and that encryption keys must be rotated automatically. Which solution provides the MOST secure and compliant method to meet these requirements?
- A
Use Amazon S3 default server-side encryption (SSE-S3) with no additional configuration.
- B
Use Amazon S3 server-side encryption with AWS Key Management Service (SSE-KMS) and enable automatic key rotation in KMS.
- C
Encrypt data on the client side using a custom key management solution and upload it to Amazon S3.
- D
Use Amazon S3 server-side encryption with customer-provided keys (SSE-C) and rotate keys manually.
Show answer and explanation
Correct answer: B
Explanation
The most secure and compliant method to meet the requirements is to use Amazon S3 server-side encryption with AWS Key Management Service (SSE-KMS). AWS KMS allows for centralized key management, including automatic key rotation, which ensures compliance with security standards and reduces operational overhead. While other options provide encryption, they either lack automatic key rotation or require significant manual effort, making them less suitable for this scenario.
- A. Incorrect.
SSE-S3 provides encryption at rest using AWS-managed keys, but it does not allow you to configure or rotate keys yourself, which is a compliance requirement in this scenario.
- B. Correct.
SSE-KMS integrates with AWS Key Management Service, allowing you to manage the encryption keys and enable automatic key rotation, which satisfies the compliance requirements for secure encryption and key rotation.
- C. Incorrect.
Encrypting data on the client side with a custom key management solution can meet compliance requirements, but it adds significant operational complexity and is not the most secure and recommended option within the AWS ecosystem.
- D. Incorrect.
SSE-C allows you to use customer-provided keys for encryption, but AWS does not manage or rotate these keys for you, making it unsuitable for the automatic key rotation requirement.