SCS-C02 Question 379
Select 2An organization is managing sensitive financial data stored in Amazon S3. They want to enforce strict encryption policies and ensure that data is securely deleted after its retention period. Which combination of controls should be implemented to meet these requirements?
- A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) for the S3 bucket.
- B
Use S3 Lifecycle policies to transition objects to Amazon S3 Glacier and automatically delete them after the retention period.
- C
Enable S3 Object Lock with Compliance mode to prevent accidental deletion of sensitive data.
- D
Disable versioning on the S3 bucket to avoid retaining unnecessary object versions.
- E
Configure Access Analyzer for S3 to monitor and audit bucket permissions.
Show answer and explanation
Correct answers: A, B
Explanation
To manage the lifecycle of data at rest, the organization must ensure data is encrypted and securely deleted after its retention period. Enabling SSE-KMS ensures the data is encrypted with strong encryption standards, while S3 Lifecycle policies allow for transitioning and eventual deletion of data according to the defined retention period. Other options, such as enabling S3 Object Lock or disabling versioning, do not fulfill these requirements.
- A. Correct.
This is correct because SSE-KMS provides strong encryption for data at rest using customer-managed keys, ensuring compliance with encryption requirements for sensitive data.
- B. Correct.
This is correct because S3 Lifecycle policies allow you to manage data lifecycle by transitioning data to lower-cost storage classes like Glacier and securely deleting it after the retention period.
- C. Incorrect.
This is incorrect because S3 Object Lock in Compliance mode prevents deletion, which is contrary to the requirement of securely deleting data after the retention period.
- D. Incorrect.
This is incorrect because disabling versioning reduces the ability to recover previous versions of data and does not directly contribute to encryption or secure deletion.
- E. Incorrect.
This is incorrect because Access Analyzer helps monitor bucket permissions but does not address encryption or secure data deletion requirements.