SCS-C02 Question 422
Select 4Your organization uses Amazon S3 to store sensitive customer data. To comply with regulatory requirements, you need to ensure that all data is encrypted at rest and that unauthorized access is prevented. Additionally, you want to monitor access patterns to detect any anomalies. Which combination of actions should you take to meet these requirements?
- A
Enable default encryption on the Amazon S3 bucket using AWS Key Management Service (KMS) keys.
- B
Enable S3 Block Public Access settings for the bucket to prevent unauthorized public access.
- C
Use AWS CloudTrail to log and monitor API access to the S3 bucket.
- D
Enable Amazon S3 Transfer Acceleration to enhance data transfer speeds for sensitive data.
- E
Configure Amazon Macie for sensitive data discovery and anomaly detection.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To meet the requirements of encrypting sensitive customer data at rest, preventing unauthorized access, and monitoring access patterns for anomalies, you should enable default encryption with AWS KMS keys, enable S3 Block Public Access, use AWS CloudTrail for logging and monitoring, and configure Amazon Macie for sensitive data discovery and anomaly detection. Amazon S3 Transfer Acceleration, while useful for improving performance, does not contribute to the security and compliance aspects of this scenario.
- A. Correct.
Enabling default encryption with AWS KMS keys ensures that all data stored in the S3 bucket is encrypted at rest, meeting the regulatory requirement for encryption.
- B. Correct.
S3 Block Public Access settings help prevent unauthorized public access to sensitive data, enhancing security.
- C. Correct.
AWS CloudTrail logs and monitors API-level access to the S3 bucket, allowing you to track and investigate access patterns.
- D. Incorrect.
Amazon S3 Transfer Acceleration is used to improve data transfer speeds but does not provide security or compliance features.
- E. Correct.
Amazon Macie helps identify sensitive data in S3 buckets and monitors access patterns for anomalies, aiding in compliance and security monitoring.