SCS-C02 Question 378
Select 2Your organization needs to store sensitive customer data in Amazon S3. The compliance requirements dictate that the data must be encrypted at rest, rotated periodically, and securely deleted when it is no longer required. Which combination of actions should you take to meet these requirements?
- A
Enable S3 default encryption and use AWS KMS-managed keys (SSE-KMS) for encryption.
- B
Configure an S3 Lifecycle policy to transition objects to Amazon S3 Glacier for long-term retention.
- C
Use the AWS KMS key rotation feature to automatically rotate the customer-managed keys.
- D
When deleting objects, use S3 Object Lock to place a legal hold to prevent deletion until compliance requirements are met.
- E
Manually delete the KMS key used for encryption to ensure the data becomes inaccessible once it is no longer required.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the compliance requirements for managing the lifecycle of sensitive customer data at rest in S3, you must enable encryption using AWS KMS-managed keys (SSE-KMS) to ensure data security. Additionally, AWS KMS key rotation should be used to periodically rotate keys, which aligns with lifecycle management best practices. The other options either do not address encryption and lifecycle management directly or represent insecure/incorrect practices.
- A. Correct.
Enabling S3 default encryption with AWS KMS-managed keys (SSE-KMS) ensures that data at rest is encrypted using a robust encryption standard, aligning with compliance requirements.
- B. Incorrect.
Configuring an S3 Lifecycle policy to transition objects to Glacier is a cost-optimization strategy for long-term storage but does not address encryption, key rotation, or secure deletion requirements directly.
- C. Correct.
Using the AWS KMS key rotation feature ensures that encryption keys are rotated periodically, meeting the requirement for key lifecycle management.
- D. Incorrect.
Using S3 Object Lock for a legal hold is useful for regulatory compliance but is unrelated to secure deletion or encryption key rotation.
- E. Incorrect.
Manually deleting the KMS key is not a secure or recommended practice for managing the lifecycle of data at rest because it could lead to accidental loss of access to critical data.