A company is sending historical datasets to Amazon S3 for storage. A data engineer at the company wants to make these datasets available for analysis using Amazon Athena. The engineer also wants to…

Question

Options

• AUse server-side encryption with S3 managed encryption keys (SSE-S3) for the primary dataset.
• BUse server-side encryption with customer-provided encryption keys (SSE-C) for the primary
• CUse server-side encryption with AWS KMS managed customer master keys (SSE-KMS CMKs)
• DUse client-side encryption with AWS Key Management Service (AWS KMS) customer managed

• A
  4% (1)
• C
  86% (24)
• D
  11% (3)

Explanation

Option C uses SSE-KMS with customer-managed CMKs (Customer Master Keys) for primary dataset query results. KMS CMKs satisfy all three requirements: they are custom (customer-managed) keys, they provide an audit trail in AWS CloudTrail showing every key usage event including who used the key and when, and they give full control over key policies. Generic encryption for all other query results is handled by SSE-S3, which uses AWS-managed keys and requires no customer management. Option A (SSE-S3) uses AWS-managed keys and provides no audit trail. Option B (SSE-C) requires the caller to supply the key material with every request; Athena does not support SSE-C for query result encryption. Option D (client-side encryption) is also unsupported by Athena for query results.

No community discussion yet for this question.