SCS-C02 Question 321
Single answerYour organization stores sensitive customer data in an Amazon S3 bucket. To comply with internal security policies, the data must be encrypted at rest, and you must also be able to audit the encryption keys' usage. Which solution will meet these requirements?
- A
Use Amazon S3 server-side encryption with S3-managed keys (SSE-S3).
- B
Use Amazon S3 server-side encryption with AWS Key Management Service (SSE-KMS) and enable CloudTrail logging.
- C
Use Amazon S3 server-side encryption with customer-provided keys (SSE-C).
- D
Use client-side encryption with a custom encryption library and store the keys in an on-premises key management solution.
Show answer and explanation
Correct answer: B
Explanation
The requirement to encrypt data at rest and audit the usage of encryption keys makes SSE-KMS the optimal solution. SSE-KMS integrates with AWS KMS, which provides centralized key management and auditing capabilities through AWS CloudTrail. This ensures compliance with the organization's internal security policies while leveraging AWS-managed services efficiently.
- A. Incorrect.
SSE-S3 encrypts data at rest, but it does not provide the ability to audit encryption key usage because AWS manages the encryption keys entirely.
- B. Correct.
SSE-KMS encrypts data at rest and integrates with AWS Key Management Service, which provides detailed audit logs of key usage through AWS CloudTrail. Enabling CloudTrail logging ensures you meet both encryption and auditing requirements.
- C. Incorrect.
SSE-C allows you to provide your own encryption keys, but AWS does not manage or audit the keys, making it unsuitable for the requirement to audit encryption key usage.
- D. Incorrect.
Client-side encryption with a custom library and on-premises key management can encrypt data, but auditing the keys' usage would require a custom solution, adding significant operational overhead and complexity compared to SSE-KMS.