SCS-C02 Question 361
Single answerYou are designing a secure file storage application on AWS where customers upload sensitive documents. The requirements include: 1) ensuring data is encrypted both during transit and at rest, 2) customers should manage their own encryption keys for compliance reasons, and 3) the encryption process should minimize latency. Which encryption technique is most appropriate for this use case?
- A
Client-side encryption using symmetric keys
- B
Server-side encryption with AWS KMS and customer-managed keys (CMKs)
- C
Server-side encryption with AWS-managed keys (SSE-S3)
- D
Client-side encryption using asymmetric keys
Show answer and explanation
Correct answer: A
Explanation
Client-side encryption using symmetric keys meets all the requirements of the scenario: it ensures data is encrypted before being sent to AWS (encryption in transit), allows customers to manage their own keys for compliance, and minimizes latency compared to asymmetric encryption. While server-side encryption options can simplify the process, they do not allow the same level of key management control required in this scenario.
- A. Correct.
Client-side encryption using symmetric keys is the best fit for this scenario since it allows customers to manage their own encryption keys while providing lower latency compared to asymmetric encryption. It also ensures data is encrypted before being sent to AWS, meeting the security requirements.
- B. Incorrect.
Server-side encryption with AWS KMS and customer-managed keys (CMKs) would not fully meet the requirement of allowing customers to directly manage their keys. AWS KMS provides key management, but the keys are still stored within AWS.
- C. Incorrect.
Server-side encryption with AWS-managed keys (SSE-S3) does not give customers control over their encryption keys, which violates the compliance requirement.
- D. Incorrect.
Client-side encryption using asymmetric keys allows customers to manage their keys but introduces higher latency due to the computational overhead of asymmetric encryption, making it less suitable for this use case.