SCS-C02 Question 489
Single answerAn organization uses an S3 bucket to store sensitive financial documents. The security team requires that the data in the bucket must be encrypted at rest and also wants to ensure that the encryption keys are centrally managed and rotated automatically. Which solution best meets these requirements?
- A
Enable S3 default encryption with Amazon S3-Managed Keys (SSE-S3).
- B
Enable S3 default encryption with AWS Key Management Service (KMS)-Managed Keys (SSE-KMS).
- C
Use client-side encryption with a custom encryption library and upload encrypted data to S3.
- D
Manually encrypt data using AWS Encryption SDK and upload it to the S3 bucket.
Show answer and explanation
Correct answer: B
Explanation
AWS Key Management Service (KMS)-Managed Keys (SSE-KMS) is the best solution in this scenario because it automatically encrypts S3 data at rest, provides centralized key management, and supports automatic key rotation, meeting all the organization's requirements. While other options provide encryption, they either lack key management or require manual operations, making them less suitable.
- A. Incorrect.
S3 default encryption with SSE-S3 encrypts data at rest, but the keys are managed by Amazon S3 and do not provide central management or automatic rotation by AWS KMS.
- B. Correct.
S3 default encryption with SSE-KMS meets the requirements as it encrypts data at rest, allows central management of encryption keys via AWS KMS, and automatically rotates keys as per AWS KMS policies.
- C. Incorrect.
Client-side encryption requires the organization to manage and rotate the keys manually, which does not meet the central management and automatic rotation requirements.
- D. Incorrect.
Manually encrypting data with AWS Encryption SDK requires custom key management and rotation by the organization, which does not fulfill the central management and automatic rotation requirements.