SCS-C02 Question 209
Single answerYour company stores sensitive customer data in an Amazon S3 bucket. To comply with security policies, you need to ensure that the data is encrypted at rest with a customer-provided key. Which solution will best meet this requirement?
- A
Use Amazon S3 Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3).
- B
Use Amazon S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS).
- C
Use Amazon S3 Server-Side Encryption with Customer-Provided Keys (SSE-C).
- D
Use Amazon S3 Client-Side Encryption with a key that you generate and manage.
Show answer and explanation
Correct answer: C
Explanation
To meet the requirement of encrypting data at rest with a customer-provided key, you need to use Amazon S3 Server-Side Encryption with Customer-Provided Keys (SSE-C). This option ensures that the encryption is managed server-side while allowing you to supply your own encryption key. Other options, like SSE-S3 and SSE-KMS, rely on AWS-managed keys, which do not fulfill the requirement of using a customer-provided key.
- A. Incorrect.
This option uses keys managed by Amazon S3 and does not allow you to use your own customer-provided key, so it does not meet the requirement.
- B. Incorrect.
This option uses keys managed through AWS KMS, which are not customer-provided keys as required in the scenario.
- C. Correct.
This option allows you to use customer-provided encryption keys (SSE-C), making it the correct solution for the scenario.
- D. Incorrect.
While client-side encryption allows you to manage your own keys, it does not meet the requirement of using server-side encryption with a customer-provided key in this scenario.