SAA-C03 · Question #754
A software as a service (SaaS) company runs a multi-tenant data lake by using Amazon S3. Each tenant's data is stored in an isolated data path in an S3 bucket. The data lake supports custom…
The correct answer is C. Use S3 prefixes for each tenant's data. Use server-side encryption with AWS KMS keys (SSE-. Server-side encryption with AWS KMS keys (SSE-KMS) allows tenants to use their own KMS keys for a subset of data while enabling S3-managed encryption (SSE-S3) for other data. SSE- KMS–encrypted objects support Cross-Region Replication, which can be configured using prefixes to…
Question
A software as a service (SaaS) company runs a multi-tenant data lake by using Amazon S3. Each tenant’s data is stored in an isolated data path in an S3 bucket. The data lake supports custom encryption for each tenant. The company wants to allow tenants to use their own keys to encrypt only a subset of their data. The rest of the data will use server-side encryption with Amazon S3 managed keys (SSE-S3). The company needs to set up ongoing data replication to another S3 bucket in a different AWS Region for the objects encrypted with imported keys. Which solution will meet these requirements?
Options
- AUse S3 prefixes for each tenant's data. Use server-side encryption with AWS KMS keys (SSE-
- BUse S3 prefixes for each tenant's data. Use server-side encryption with customer-provided keys
- CUse S3 prefixes for each tenant's data. Use server-side encryption with AWS KMS keys (SSE-
- DCreate a separate S3 bucket for each tenant. Use server-side encryption with customer-provided
How the community answered
(32 responses)- A16% (5)
- B6% (2)
- C50% (16)
- D28% (9)
Explanation
Server-side encryption with AWS KMS keys (SSE-KMS) allows tenants to use their own KMS keys for a subset of data while enabling S3-managed encryption (SSE-S3) for other data. SSE- KMS–encrypted objects support Cross-Region Replication, which can be configured using prefixes to replicate tenant-specific data to another S3 bucket in a different region. SSE-C cannot be used with CRR, so SSE-KMS is required.
Community Discussion
No community discussion yet for this question.