SCS-C02 Question 211
Select 3Your organization uses an Amazon S3 bucket to store sensitive customer data. The security team has recently identified the need to ensure that the data is encrypted at rest and that access is logged for auditing purposes. Additionally, any accidental public access to the bucket must be prevented. Which combination of actions will meet these requirements?
- A
Enable server-side encryption (SSE) on the bucket using AWS Key Management Service (KMS) keys.
- B
Enable the S3 Block Public Access settings for the bucket.
- C
Enable Amazon S3 server access logging and configure the logs to be stored in another S3 bucket.
- D
Use an S3 bucket policy to allow all users in the organization full access to the bucket.
- E
Enable Cross-Region Replication to replicate the bucket data to another region for redundancy.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the security requirements, you must ensure encryption at rest, prevent public access, and enable logging for auditing. Server-side encryption (SSE) with AWS KMS provides strong encryption for sensitive data. Enabling S3 Block Public Access ensures no accidental public access occurs, and enabling S3 server access logging provides valuable access records for auditing purposes. These steps collectively fulfill the security team's requirements.
- A. Correct.
Correct. Enabling server-side encryption (SSE) with AWS KMS ensures that the data stored in the bucket is encrypted at rest, meeting the encryption requirement.
- B. Correct.
Correct. Enabling S3 Block Public Access settings prevents any accidental public access to the bucket, addressing the requirement to secure sensitive data.
- C. Correct.
Correct. Enabling S3 server access logging allows you to track access requests to the bucket and store logs for auditing purposes, fulfilling the auditing requirement.
- D. Incorrect.
Incorrect. Allowing all users in the organization full access to the bucket does not align with the requirement to secure sensitive customer data.
- E. Incorrect.
Incorrect. While Cross-Region Replication improves redundancy, it does not address encryption at rest, access logging, or preventing public access.