SCS-C02 Question 491
Single answerYour organization uses an S3 bucket to store sensitive financial data. The bucket is configured with server-side encryption using SSE-S3 (AES-256). However, your security audit team has raised concerns about the lack of granular control over encryption keys. They recommend moving to a solution where the organization manages its own encryption keys. Which approach should you take to meet this requirement while ensuring minimal disruption to existing workflows?
- A
Switch the bucket encryption to SSE-KMS and use an AWS-managed CMK.
- B
Switch the bucket encryption to SSE-KMS and use a customer-managed CMK.
- C
Switch the bucket encryption to Client-Side Encryption with AWS SDKs.
- D
Switch the bucket encryption to SSE-C and supply your own encryption keys with each request.
Show answer and explanation
Correct answer: B
Explanation
The requirement is to move to a solution where the organization manages its own encryption keys while minimizing workflow disruptions. Switching to SSE-KMS with a customer-managed CMK is the best choice because it allows the organization to control the lifecycle and policies of the keys without requiring application-level changes. SSE-S3 and AWS-managed CMKs do not provide the desired level of control over encryption keys. Client-Side Encryption and SSE-C involve significant changes to client applications, which do not align with the requirement for minimal disruption.
- A. Incorrect.
Using AWS-managed CMKs with SSE-KMS provides more control than SSE-S3, but it does not allow you to fully manage the lifecycle of keys, which is a specific requirement in this scenario.
- B. Correct.
Using a customer-managed CMK with SSE-KMS allows you to manage the encryption key lifecycle, including rotation, permission policies, and deletion, which satisfies the requirement for key management by the organization.
- C. Incorrect.
Client-Side Encryption would shift the encryption responsibility to the client-side, which requires significant changes to workflows and is not the minimal disruption solution asked for in the scenario.
- D. Incorrect.
SSE-C allows you to supply your own encryption keys for each request, but this requires significant changes to client applications to include key management in every API call, which is not a minimal disruption solution.