SCS-C02 Question 364
Select 3An organization needs to ensure the integrity of sensitive files stored in an Amazon S3 bucket. The security team must validate that the files have not been altered after being uploaded. Which of the following techniques can be used to achieve this?
- A
Generate an MD5 hash of the files before and after uploading, then compare the hashes.
- B
Use Amazon S3 bucket versioning to track changes to the files.
- C
Sign the files with a private key and verify them using the corresponding public key.
- D
Enable server-side encryption with Amazon S3-managed keys (SSE-S3).
- E
Use a SHA-256 hash algorithm to compute a checksum of the files and store it for future comparison.
Show answer and explanation
Correct answers: A, C, E
Explanation
To ensure the integrity of files stored in Amazon S3, hashing (e.g., MD5 or SHA-256) and digital signatures are valid and recommended techniques. Hashing verifies that the file content remains unchanged by comparing the original and computed hashes. Digital signatures, on the other hand, ensure both integrity and authenticity by detecting unauthorized modifications. S3 bucket versioning and encryption serve other purposes and do not directly validate file integrity.
- A. Correct.
Generating an MD5 hash of the files and comparing the hashes is a valid technique for verifying file integrity, as the hash will change if the file is altered.
- B. Incorrect.
While Amazon S3 bucket versioning tracks changes to the files, it does not verify the integrity of the file contents themselves. It is more about keeping historical versions, not validating content integrity.
- C. Correct.
Signing the files with a private key and verifying them using the corresponding public key ensures the integrity and authenticity of the files. Any modification to the files will invalidate the signature.
- D. Incorrect.
Server-side encryption with Amazon S3-managed keys (SSE-S3) provides confidentiality but does not address the need for validating file integrity.
- E. Correct.
Using a SHA-256 hash algorithm to compute and store a checksum of the files is an effective technique for ensuring file integrity, as it allows future comparisons to detect changes.