SCS-C02 Question 328
Select 3You are configuring an Amazon S3 bucket to store sensitive customer data. To comply with your organization's security policies, you must ensure that the data is encrypted both at rest and in transit. Additionally, only specific IAM roles should be allowed access to the bucket. Which combination of configurations should you implement to achieve this?
- A
Enable server-side encryption (SSE) with AWS Key Management Service (SSE-KMS) for the S3 bucket.
- B
Apply a bucket policy that denies access to all users except those with specific IAM roles.
- C
Enable S3 Versioning to maintain a history of all object changes.
- D
Require the use of HTTPS (TLS) for all requests to the bucket by configuring a bucket policy.
- E
Enable S3 Transfer Acceleration to encrypt data during transit.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely store sensitive customer data, you must implement encryption at rest (using SSE-KMS) and in transit (by enforcing HTTPS). Additionally, restricting access to specific IAM roles via a bucket policy ensures only authorized users can access the bucket. S3 Versioning and Transfer Acceleration, while useful for other purposes, do not directly satisfy the encryption and access control requirements in this scenario.
- A. Correct.
This is correct. Enabling SSE-KMS ensures that data is encrypted at rest using AWS-managed or customer-managed keys, which is essential for protecting sensitive data.
- B. Correct.
This is correct. Applying a bucket policy to restrict access to specific IAM roles ensures that only authorized users can access the bucket, meeting the security policy requirements.
- C. Incorrect.
This is incorrect. S3 Versioning helps with data recovery and maintaining object history but does not address encryption or access control requirements.
- D. Correct.
This is correct. Requiring HTTPS ensures that data is encrypted in transit, which is necessary for protecting sensitive data during transmission.
- E. Incorrect.
This is incorrect. S3 Transfer Acceleration improves data transfer speeds but does not specifically address encryption requirements.