SOA-C02 Question 212
Single answerYou are managing an Amazon S3 bucket that stores sensitive financial data. The compliance team requires that the data be encrypted at rest using a customer-managed key in AWS Key Management Service (AWS KMS). What must you do to meet this requirement?
- A
Enable default encryption on the S3 bucket and select the customer-managed key from AWS KMS.
- B
Use AWS CloudTrail to enforce encryption using a customer-managed key.
- C
Attach an IAM policy to the S3 bucket to enforce encryption using a customer-managed key.
- D
Enable server-side encryption with Amazon S3-managed keys (SSE-S3) for the bucket.
Show answer and explanation
Correct answer: A
Explanation
To meet the compliance requirement for encrypting data at rest using a customer-managed key in AWS KMS, you must enable default encryption on the bucket and specify the customer-managed key. This ensures that all new objects uploaded to the S3 bucket are encrypted using the selected key, providing the required security and compliance.
- A. Correct.
Correct. Enabling default encryption and selecting the customer-managed key in AWS KMS ensures that all objects stored in the bucket are encrypted at rest using the specified key.
- B. Incorrect.
Incorrect. AWS CloudTrail is used for logging and monitoring API activity, but it does not enforce encryption settings on an S3 bucket.
- C. Incorrect.
Incorrect. While IAM policies can control access to the bucket, they do not directly enforce encryption settings.
- D. Incorrect.
Incorrect. SSE-S3 uses Amazon S3-managed keys, not customer-managed keys in AWS KMS, which does not meet the compliance team's requirement.