SCS-C02 Question 331
Select 2A company stores sensitive customer data in an S3 bucket and needs to enforce strict security controls to protect the data. They want to ensure that only specific IAM roles can access the bucket and that data is encrypted both in transit and at rest. Which combination of actions should the company take to meet these requirements?
- A
Enable server-side encryption (SSE) with AWS Key Management Service (SSE-KMS) for the S3 bucket.
- B
Apply an S3 bucket policy that explicitly denies access to all principals except the specified IAM roles.
- C
Enable S3 Transfer Acceleration to ensure data is encrypted during upload.
- D
Configure AWS CloudTrail to log all API requests made to the S3 bucket.
- E
Enable S3 Default Encryption with SSE-S3 for the bucket.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements, the company must ensure that data is encrypted both at rest and in transit, and access is restricted to specific IAM roles. Enabling SSE-KMS encrypts data at rest with robust key management capabilities, while applying a bucket policy to deny access to all except specific IAM roles restricts access effectively. Other options, while useful for different purposes, do not comprehensively address the stated requirements.
- A. Correct.
This option is correct because enabling SSE-KMS ensures that data is encrypted at rest using AWS Key Management Service, providing strong encryption and control over access to the encryption keys.
- B. Correct.
This option is correct because applying a bucket policy to explicitly deny access to all principals except specific IAM roles enforces strict access controls at the bucket level.
- C. Incorrect.
This option is incorrect because S3 Transfer Acceleration is used to speed up data transfers to S3 and does not specifically address encryption in transit. Encryption in transit is handled via HTTPS.
- D. Incorrect.
This option is incorrect because enabling AWS CloudTrail is useful for auditing access and tracking API calls, but it does not enforce encryption or restrict access to specific IAM roles.
- E. Incorrect.
This option is incorrect because while SSE-S3 ensures encryption at rest, it does not provide the fine-grained control over encryption keys that SSE-KMS does, making SSE-KMS a stronger choice for sensitive data.