SCS-C02 Question 320
Single answerAn organization needs to ensure that sensitive customer data stored in Amazon S3 is protected from unauthorized access. They want to encrypt the data at rest using AWS-managed keys while maintaining detailed access control. Additionally, they require the ability to audit the use of encryption keys. Which solution best meets these requirements?
- A
Use Amazon S3 default encryption with AES-256 and enable S3 server access logging.
- B
Use Amazon S3 default encryption with AWS Key Management Service (KMS) keys and enable AWS CloudTrail logging.
- C
Encrypt the data manually using client-side encryption before uploading it to S3, and manage the encryption keys internally.
- D
Use Amazon S3 default encryption with AWS KMS keys and enable detailed bucket policies for access control.
Show answer and explanation
Correct answer: B
Explanation
Using Amazon S3 default encryption with AWS KMS keys ensures that data is encrypted at rest using AWS-managed keys. AWS KMS provides centralized management of encryption keys and integrates with AWS CloudTrail to enable auditing of key usage. This meets the organization's requirements for encryption, access control, and auditability, making it the most appropriate solution.
- A. Incorrect.
Amazon S3 default encryption with AES-256 provides encryption at rest, but it does not integrate with AWS KMS or provide centralized key management and audit logging capabilities.
- B. Correct.
Using Amazon S3 default encryption with AWS KMS keys integrates with AWS Key Management Service, allowing centralized management of encryption keys, detailed access control, and auditing capabilities via AWS CloudTrail. This solution meets all the stated requirements.
- C. Incorrect.
While client-side encryption provides strong data protection, managing encryption keys internally adds complexity and does not leverage AWS KMS or provide native audit capabilities.
- D. Incorrect.
Enabling detailed bucket policies controls access to S3 buckets but does not inherently provide audit trails for key usage. AWS KMS integration is required for centralized key management and auditing.