A company stores sensitive financial reports in an Amazon S3 bucket. To comply with auditing requirements, the company must encrypt the data at rest. Users must not have the ability to change the…

Question

Options

• AEnable default server-side encryption with Amazon S3 managed keys (SSE-S3) for the S3
• BConfigure server-side encryption with AWS KMS (SSE-KMS) keys. Use an S3 bucket policy to
• CUse client-side encryption before uploading the reports. Store the encryption keys in AWS
• DEnable default server-side encryption with Amazon S3 managed keys (SSE-S3). Use AWS

• A
  23% (5)
• B
  64% (14)
• C
  9% (2)
• D
  5% (1)

Explanation

AWS KMS with SSE-KMS provides granular key management and auditability. All use of KMS keys is logged in AWS CloudTrail, which allows compliance teams to monitor encryption and decryption operations. A bucket policy can be configured to enforce uploads only with the designated KMS key, ensuring that users cannot bypass encryption or change methods. Option A (SSE-S3 with bucket policy) enforces encryption but does not provide the same level of control or auditable key usage. Option C (client-side encryption) increases complexity and key management burden. Option D prevents bucket setting changes but does not prevent unencrypted uploads. Therefore, B ensures the most granular control, auditability, and compliance with financial data

No community discussion yet for this question.