SAA-C03 · Question #652
A company runs an application that generates sensitive archival files and stores them in an Amazon S3 bucket. Partner companies consume the archival files from the S3 bucket. The company wants to rear
The correct answer is D. Configure the application to use client-side encryption with a key that is stored in AWS Key. Client-side encryption ensures that data is encrypted before it leaves the application and is uploaded to Amazon S3. By using a KMS-stored key, the company controls the encryption process, guaranteeing that no unencrypted data is ever written to S3. This setup prevents partner co
Question
A company runs an application that generates sensitive archival files and stores them in an Amazon S3 bucket. Partner companies consume the archival files from the S3 bucket. The company wants to rearchitect the application’s data storage. The company must ensure that the partner companies do not have access to the data before the company encrypts the data and sends it to the S3 bucket. Which solution will meet these requirements?
Options
- AConfigure the S3 bucket to use client-side encryption with an Amazon S3 managed encryption
- BConfigure the S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS).
- CConfigure the S3 bucket to use dual-layer server-side encryption with AWS KMS keys (DSSE-
- DConfigure the application to use client-side encryption with a key that is stored in AWS Key
How the community answered
(27 responses)- A11% (3)
- B7% (2)
- C4% (1)
- D78% (21)
Explanation
Client-side encryption ensures that data is encrypted before it leaves the application and is uploaded to Amazon S3. By using a KMS-stored key, the company controls the encryption process, guaranteeing that no unencrypted data is ever written to S3. This setup prevents partner companies - or anyone else with S3 access - from viewing data before encryption, fully meeting the security requirement.
Community Discussion
No community discussion yet for this question.