SCS-C02 Question 353
Single answerYour company is storing sensitive customer data in Amazon S3. You are tasked with ensuring the confidentiality and integrity of this data at rest. Additionally, the solution must enforce key rotation policies automatically and allow auditing of key usage. Which solution would best meet these requirements?
- A
Use Amazon S3 Server-Side Encryption with S3-Managed Keys (SSE-S3).
- B
Use Amazon S3 Server-Side Encryption with AWS Key Management Service (SSE-KMS) and configure a key rotation policy.
- C
Encrypt the data on-premises before uploading it to Amazon S3 using a custom encryption library.
- D
Use Amazon S3 Server-Side Encryption with Customer-Provided Keys (SSE-C).
Show answer and explanation
Correct answer: B
Explanation
The best solution to ensure confidentiality and integrity of data at rest in Amazon S3, while also meeting the requirements for automatic key rotation and auditing, is to use Server-Side Encryption with AWS Key Management Service (SSE-KMS). SSE-KMS integrates with AWS KMS to manage encryption keys securely, supports automatic key rotation, and provides detailed key usage logs via AWS CloudTrail for auditing purposes.
- A. Incorrect.
SSE-S3 encrypts data at rest using AES-256 encryption, but it does not support automatic key rotation or allow auditing of key usage. This does not fully meet the requirements.
- B. Correct.
SSE-KMS integrates with AWS Key Management Service (KMS), which supports automatic key rotation and provides detailed key usage logs via AWS CloudTrail. This fully meets the requirements for confidentiality, integrity, key rotation, and auditing.
- C. Incorrect.
Encrypting data on-premises provides confidentiality and integrity, but it does not offer automatic key rotation or auditing capabilities through AWS services. The burden of managing encryption keys remains on the customer.
- D. Incorrect.
SSE-C allows you to provide your own encryption keys for Amazon S3, but it requires manual key management and does not offer automatic key rotation or auditing within AWS. This does not fulfill all the requirements.