SCS-C02 Question 366
Select 2An e-commerce company stores sensitive customer order data on Amazon S3. The security team is instructed to ensure that the files have not been tampered with during storage or transit. Which of the following techniques can be used to verify the integrity of the files?
- A
Calculate a hash of the files using SHA-256 and compare it to a previously stored hash value.
- B
Apply an AWS Key Management Service (KMS) encryption key to the files.
- C
Use S3 Versioning to track file changes and verify integrity.
- D
Generate a digital signature for the files using a private key and verify it using the corresponding public key.
Show answer and explanation
Correct answers: A, D
Explanation
Ensuring the integrity of files involves verifying that they have not been altered, either during storage or transit. Techniques like hashing (e.g., SHA-256) and digital signatures are specifically designed for such purposes. Hashing provides a fixed-length representation of data, which can be compared to previous values to detect changes. Digital signatures, on the other hand, also include authenticity by using cryptographic key pairs. Other methods like encryption or versioning serve different purposes and are not suitable for integrity verification.
- A. Correct.
Correct: Hashing algorithms like SHA-256 are commonly used for integrity verification. Comparing a newly calculated hash with a previously stored one ensures that the file has not been altered.
- B. Incorrect.
Incorrect: Encryption, including AWS KMS, is used to protect data confidentiality, not integrity verification.
- C. Incorrect.
Incorrect: S3 Versioning helps track changes to objects but does not provide mechanisms to verify data integrity.
- D. Correct.
Correct: Digital signatures verify both the integrity and authenticity of data. Any modification to the data will result in a signature mismatch when verified with the public key.