SCS-C02 Question 381
Select 3An organization uses Amazon S3 to store sensitive financial data. To comply with security and compliance requirements, they need to ensure that all data stored in the S3 bucket is encrypted and that only specific IAM roles can access the bucket. Additionally, they want to log all access requests made to the S3 bucket for auditing purposes. Which combination of actions should the organization take to meet these requirements?
- A
Enable server-side encryption with AWS Key Management Service (SSE-KMS) on the S3 bucket.
- B
Use an S3 bucket policy to restrict access to specific IAM roles.
- C
Enable default encryption using SSE-S3 on the S3 bucket.
- D
Enable S3 server access logging to capture access requests.
- E
Enable AWS CloudTrail data event logging for the S3 bucket.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the requirements for encrypting sensitive financial data, restricting access to specific IAM roles, and logging all access requests, the organization should enable SSE-KMS for strong encryption and key management, implement an S3 bucket policy to restrict access, and enable AWS CloudTrail data event logging for detailed audit logs. While SSE-S3 and S3 server access logging are useful, they do not fully satisfy the organization's compliance and security requirements in this scenario.
- A. Correct.
Correct: Enabling SSE-KMS ensures that all data is encrypted using keys managed by AWS Key Management Service, providing strong encryption and key management capabilities.
- B. Correct.
Correct: Using an S3 bucket policy enables you to explicitly define which IAM roles are allowed or denied access to the bucket, meeting the access control requirement.
- C. Incorrect.
Incorrect: While SSE-S3 encrypts data at rest, it does not provide the same level of key management granularity and audit capabilities as SSE-KMS, which is recommended for sensitive financial data.
- D. Incorrect.
Incorrect: S3 server access logging provides basic access logs but does not capture the level of detail required for auditing purposes, such as which IAM user or role accessed the bucket.
- E. Correct.
Correct: AWS CloudTrail data event logging captures detailed information about API calls made to the S3 bucket, which is essential for auditing and compliance.