SOA-C02 Question 168
Select 3You are managing an AWS environment for a company that stores sensitive customer data. The compliance team requires that all data in Amazon S3 buckets be encrypted at rest and that unauthorized access attempts be monitored. Which combination of steps will meet these requirements?
- A
Enable default encryption on the S3 bucket and use an AWS Key Management Service (KMS) key.
- B
Create an Amazon CloudWatch alarm to monitor unauthorized access to the S3 bucket.
- C
Enable S3 bucket logging and send logs to CloudTrail for auditing.
- D
Use an IAM policy to block unencrypted uploads to the S3 bucket.
- E
Enable S3 Object Lock to prevent unauthorized deletions.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the compliance requirements, you need to ensure that all S3 data is encrypted at rest and monitor unauthorized access attempts. Enabling default encryption with AWS KMS ensures encryption at rest for all uploaded objects. Sending S3 bucket logs to CloudTrail allows you to audit and monitor access attempts, including unauthorized actions. Finally, using an IAM policy to block unencrypted uploads enforces encryption rules, preventing non-compliant uploads. S3 Object Lock and CloudWatch alarms, while useful for other purposes, do not directly address these specific requirements.
- A. Correct.
Correct: Enabling default encryption ensures that all newly uploaded data is encrypted at rest. Using AWS KMS allows for centralized key management and compliance with security policies.
- B. Incorrect.
Incorrect: CloudWatch alarms can monitor metrics but are not designed to detect unauthorized access attempts to an S3 bucket. Instead, you would rely on CloudTrail logs for such monitoring.
- C. Correct.
Correct: Enabling S3 bucket logging and sending logs to AWS CloudTrail allows you to monitor and audit access attempts, including unauthorized ones.
- D. Correct.
Correct: An IAM policy that blocks unencrypted uploads ensures compliance with encryption requirements by preventing users from bypassing default encryption settings.
- E. Incorrect.
Incorrect: S3 Object Lock is designed to prevent object deletions or overwrites, which does not directly address the requirement of encryption or monitoring unauthorized access.