SCS-C02 Question 360
Single answerYour organization stores sensitive financial data in an Amazon S3 bucket. Compliance requirements mandate that the data must be encrypted before it is uploaded to the cloud, and the encryption keys should always remain under the organization's control. Which encryption method is the most appropriate to meet these requirements?
- A
Server-side encryption with AWS Key Management Service (SSE-KMS)
- B
Server-side encryption with Amazon S3-managed keys (SSE-S3)
- C
Client-side encryption with customer-managed keys
- D
Server-side encryption with customer-provided keys (SSE-C)
Show answer and explanation
Correct answer: C
Explanation
Client-side encryption with customer-managed keys is the only method that ensures the data is encrypted before being uploaded to S3 and that the organization retains full control of the encryption keys. This satisfies the compliance requirements for pre-upload encryption and key control.
- A. Incorrect.
SSE-KMS stores the encryption keys in AWS Key Management Service, not under the organization's direct control, which violates the requirement for key control.
- B. Incorrect.
SSE-S3 uses Amazon S3-managed keys, so the encryption keys are controlled by AWS rather than the organization, making this option non-compliant with the requirement.
- C. Correct.
Client-side encryption with customer-managed keys ensures that the data is encrypted before uploading to S3 and the organization retains full control of the encryption keys, meeting the compliance requirements.
- D. Incorrect.
SSE-C requires the organization to provide encryption keys for each request, but the data is encrypted server-side, not client-side, so this does not fulfill the requirement to encrypt data before uploading.