SCS-C02 Question 354
Select 2Your company stores sensitive customer data in an Amazon S3 bucket. To ensure compliance with regulatory requirements, you must implement a solution that guarantees both the confidentiality and integrity of the data at rest. Which of the following steps should you take to meet these requirements?
- A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) on the S3 bucket
- B
Apply an S3 bucket policy to restrict access to specific IAM roles and users
- C
Use client-side encryption to encrypt data before uploading it to the S3 bucket
- D
Enable versioning on the S3 bucket to maintain historical versions of the objects
- E
Enable Object Lock in Compliance mode to prevent accidental deletion or modification of data
Show answer and explanation
Correct answers: A, C
Explanation
To ensure confidentiality and integrity for data at rest in Amazon S3, it is critical to encrypt the data. Server-side encryption with AWS Key Management Service (SSE-KMS) provides encryption at rest using managed keys, while client-side encryption ensures that data is encrypted before it is transmitted to AWS. These approaches directly address the requirements for confidentiality and integrity. Other options, such as bucket policies or versioning, are useful for access control or data recovery but do not directly ensure encryption or integrity of the stored data.
- A. Correct.
Enabling server-side encryption with AWS Key Management Service (SSE-KMS) ensures data is encrypted at rest, meeting confidentiality requirements. SSE-KMS also provides features for auditing encryption key usage, contributing to data integrity.
- B. Incorrect.
Applying an S3 bucket policy restricts access but does not directly address data confidentiality or integrity. It handles access control, not encryption or data protection.
- C. Correct.
Using client-side encryption ensures that data is encrypted before it reaches AWS infrastructure, providing an additional layer of confidentiality and integrity for data at rest.
- D. Incorrect.
Enabling versioning on the S3 bucket helps recover previous versions of data but does not directly address confidentiality or integrity for the current data at rest.
- E. Incorrect.
Enabling Object Lock in Compliance mode prevents deletion or modification of objects, which helps with immutability, but it does not directly encrypt or verify the integrity of the data.