DEA-C01 · Question #116
A company uses a data lake that is based on an Amazon S3 bucket. To comply with regulations, the company must apply two layers of server-side encryption to files that are uploaded to the S3 bucket…
The correct answer is B. Use dual-layer server-side encryption with AWS KMS keys (DSSE-KMS). Dual-Layer Server-Side Encryption with AWS KMS Keys (DSSE-KMS) is specifically designed to apply two independent layers of server-side encryption to objects in Amazon S3 in a single operation. Each layer uses a separate data encryption key managed by AWS KMS, satisfying…
Question
A company uses a data lake that is based on an Amazon S3 bucket. To comply with regulations, the company must apply two layers of server-side encryption to files that are uploaded to the S3 bucket. The company wants to use an AWS Lambda function to apply the necessary encryption. Which solution will meet these requirements?
Options
- AUse both server-side encryption with AWS KMS keys (SSE-KMS) and the Amazon S3 Encryption
- BUse dual-layer server-side encryption with AWS KMS keys (DSSE-KMS).
- CUse server-side encryption with customer-provided keys (SSE-C) before files are uploaded.
- DUse server-side encryption with AWS KMS keys (SSE-KMS).
How the community answered
(25 responses)- A4% (1)
- B84% (21)
- C8% (2)
- D4% (1)
Explanation
Dual-Layer Server-Side Encryption with AWS KMS Keys (DSSE-KMS) is specifically designed to apply two independent layers of server-side encryption to objects in Amazon S3 in a single operation. Each layer uses a separate data encryption key managed by AWS KMS, satisfying regulatory requirements for two encryption layers. SSE-KMS (D) provides only one layer. SSE-C (C) is client-side key management but still one layer per operation. Option A (combining SSE-KMS with the S3 Encryption Client) could technically work but involves client-side complexity and is not the AWS-native, purpose-built solution.
Topics
Community Discussion
No community discussion yet for this question.