SCS-C02 Question 377
Select 2A company stores sensitive customer data in Amazon S3. Compliance requirements mandate that the data must be encrypted at rest and automatically deleted after 7 years. As a Security Engineer, how should you design and implement controls to meet these requirements?
- A
Enable server-side encryption with Amazon S3-managed keys (SSE-S3) for the bucket.
- B
Configure an S3 bucket lifecycle policy to expire objects after 7 years.
- C
Enable S3 Versioning and manually delete previous versions of objects after 7 years.
- D
Use AWS Key Management Service (KMS) to create a customer-managed key and enable server-side encryption with KMS keys (SSE-KMS).
- E
Configure an Amazon S3 Event Notification to trigger an AWS Lambda function that deletes objects older than 7 years.
Show answer and explanation
Correct answers: B, D
Explanation
To meet compliance requirements, sensitive data must be encrypted at rest and automatically deleted after 7 years. SSE-KMS provides robust encryption with key management and auditing capabilities, while an S3 lifecycle policy ensures automated deletion of objects after the specified retention period. These two options together meet the stated requirements effectively.
- A. Incorrect.
While SSE-S3 provides encryption at rest, it does not allow for fine-grained key management or auditing capabilities, which may be required for compliance. SSE-KMS is a better solution for this use case.
- B. Correct.
S3 lifecycle policies are designed to automatically expire objects after a defined period, such as 7 years, fulfilling the requirement for automatic deletion.
- C. Incorrect.
While enabling S3 Versioning can be useful for data recovery, manually deleting versions is not automated and does not meet the requirement to delete objects automatically after 7 years.
- D. Correct.
Using SSE-KMS ensures encryption at rest with fine-grained control over encryption keys, meeting compliance requirements for sensitive data.
- E. Incorrect.
Using an Amazon S3 Event Notification with a Lambda function to delete objects adds unnecessary complexity when S3 lifecycle policies can achieve the same goal more efficiently.