SCS-C02 Question 356
Select 2An organization is using Amazon S3 to store sensitive financial data. The security team is tasked with ensuring that the data remains encrypted at rest and that no unencrypted objects are ever uploaded to the S3 bucket. Which combination of configurations should the security team implement to achieve this?
- A
Enable default encryption on the S3 bucket using server-side encryption (SSE).
- B
Configure an S3 bucket policy to deny any PUT requests that do not include the 'x-amz-server-side-encryption' header.
- C
Use an S3 Lifecycle Policy to automatically encrypt unencrypted objects after they are uploaded.
- D
Require all IAM users to use AWS Key Management Service (KMS) keys for encryption by default.
- E
Enable S3 Object Lock in compliance mode to prevent changes to uploaded objects.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure that all objects in the S3 bucket are encrypted at rest and prevent unencrypted objects from being uploaded, a combination of enabling default bucket encryption and enforcing encryption through an S3 bucket policy is required. Default encryption will automatically encrypt objects upon upload, while the bucket policy ensures that clients explicitly specify encryption if default encryption is misconfigured or bypassed.
- A. Correct.
Enabling default encryption ensures that all objects uploaded to the S3 bucket are automatically encrypted, even if the client does not explicitly request encryption.
- B. Correct.
An S3 bucket policy denying PUT requests without the 'x-amz-server-side-encryption' header ensures that unencrypted objects cannot be uploaded to the bucket.
- C. Incorrect.
S3 Lifecycle Policies cannot be used to encrypt objects after they are uploaded. Encryption must be applied at the time of upload.
- D. Incorrect.
AWS does not have a feature that forces IAM users to use KMS keys for encryption by default. Encryption is typically enforced at the bucket or request level.
- E. Incorrect.
S3 Object Lock in compliance mode prevents changes to objects but does not enforce encryption or ensure that uploaded objects are encrypted.