SAA-C03 · Question #643
A company is migrating a sensitive dataset to Amazon S3. A solutions architect must ensure that the data is encrypted at rest. The encryption solution needs to give the company the ability to…
The correct answer is B. Server-side encryption with AWS KMS keys (SSE-KMS). Server-side encryption with AWS KMS keys (SSE-KMS) encrypts S3 data at rest using keys managed by AWS Key Management Service. This option allows the company to generate and control its own customer-managed KMS keys while AWS handles key storage, rotation, and the…
Question
A company is migrating a sensitive dataset to Amazon S3. A solutions architect must ensure that the data is encrypted at rest. The encryption solution needs to give the company the ability to generate its own keys without obligating the company to manage key storage or the encryption process. Which solution will meet these requirements?
Options
- AServer-side encryption with Amazon S3 managed encryption keys (SSE-S3).
- BServer-side encryption with AWS KMS keys (SSE-KMS).
- CServer-side encryption with customer-provided encryption keys (SSE-C).
- DClient-side encryption with an AWS Key Management Service (AWS KMS) customer managed
How the community answered
(30 responses)- A3% (1)
- B80% (24)
- C13% (4)
- D3% (1)
Explanation
Server-side encryption with AWS KMS keys (SSE-KMS) encrypts S3 data at rest using keys managed by AWS Key Management Service. This option allows the company to generate and control its own customer-managed KMS keys while AWS handles key storage, rotation, and the encryption/decryption process, meeting the requirement for secure encryption without operational
Community Discussion
No community discussion yet for this question.