SOA-C02 Question 172
Select 3You manage an AWS environment for a company that must comply with strict regulatory requirements. The compliance team has requested that all S3 buckets storing sensitive data must have encryption enabled and that logs of bucket access should be retained for audit purposes. Which combination of actions should you take to meet these requirements?
- A
Enable server-side encryption (SSE) on the S3 buckets storing sensitive data.
- B
Enable S3 bucket versioning to track changes to objects.
- C
Enable S3 server access logging and configure it to log all access requests.
- D
Use AWS Config to track whether S3 buckets have encryption enabled.
- E
Configure an S3 bucket policy to explicitly deny unencrypted uploads.
Show answer and explanation
Correct answers: A, C, D
Explanation
The combination of enabling server-side encryption, configuring server access logging, and using AWS Config ensures compliance with the regulatory requirements for data encryption and audit logging. While other options like versioning and bucket policies are useful in certain scenarios, they do not directly address the compliance team's stated requirements.
- A. Correct.
Enabling server-side encryption (SSE) ensures that data is encrypted at rest, which is a key compliance requirement for sensitive data.
- B. Incorrect.
While versioning is useful for tracking object changes, it does not address encryption or logging requirements directly.
- C. Correct.
Enabling S3 server access logging ensures that all access requests to S3 buckets are logged, which is necessary for audit purposes.
- D. Correct.
Using AWS Config to track compliance ensures that any S3 buckets without encryption enabled are flagged, aligning with the compliance requirements.
- E. Incorrect.
Denying unencrypted uploads is helpful but not explicitly required in this scenario, as encryption can be enforced using SSE.