SCS-C02 Question 362
Single answerA financial services company processes sensitive customer data on Amazon S3. They want to ensure that all data is encrypted in transit and at rest. Additionally, the company wants to maintain control over the encryption keys and ensure that decryption can only occur on their own systems. Which encryption technique should the company use?
- A
Server-side encryption with S3-managed keys (SSE-S3)
- B
Server-side encryption with AWS KMS-managed keys (SSE-KMS)
- C
Server-side encryption with customer-provided keys (SSE-C)
- D
Client-side encryption using a customer-managed key
Show answer and explanation
Correct answer: D
Explanation
The company requires control over encryption keys and wants to ensure that decryption occurs only on their own systems. Client-side encryption using a customer-managed key fulfills these requirements by encrypting data locally before it is uploaded to Amazon S3. This ensures that AWS has no access to the encryption keys, and decryption can only take place on the systems controlled by the company. Server-side encryption options, while secure, involve AWS in key management or encryption processes, which does not fully meet the company's requirements.
- A. Incorrect.
Server-side encryption with S3-managed keys (SSE-S3) means AWS manages the encryption keys, so the company does not have direct control over the keys. This does not meet the requirement for maintaining control over the keys.
- B. Incorrect.
Server-side encryption with AWS KMS-managed keys (SSE-KMS) offers more control over encryption keys compared to SSE-S3, but the keys are still managed by AWS KMS. The company wants to ensure decryption only occurs on their systems, which is not guaranteed with this option.
- C. Incorrect.
Server-side encryption with customer-provided keys (SSE-C) allows the company to supply their own keys for encryption and decryption. However, since the encryption and decryption occur on the server side, the company cannot fully restrict decryption to their own systems.
- D. Correct.
Client-side encryption using a customer-managed key ensures that data is encrypted before it is uploaded to S3 and decrypted only on the company's systems. This method gives the company full control over the encryption keys, meeting both requirements for key control and restricting decryption to their systems.