SAP-C02 · Question #294
A health insurance company stores personally identifiable information (PII) in an Amazon S3 bucket. The company uses server-side encryption with S3 managed encryption keys (SSE-S3) to encrypt the…
The correct answer is B. In the S3 bucket properties, change the default encryption to server-side encryption with AWS. SSE-KMS provides the necessary encryption of the PII with customer-managed keys, which the company's security team controls. Setting a bucket policy to deny unencrypted PutObject requests ensures that all future objects in the bucket will be encrypted. Re-uploading all existing…
Question
A health insurance company stores personally identifiable information (PII) in an Amazon S3 bucket. The company uses server-side encryption with S3 managed encryption keys (SSE-S3) to encrypt the objects. According to a new requirement, all current and future objects in the S3 bucket must be encrypted by keys that the company's security team manages. The S3 bucket does not have versioning enabled. Which solution will meet these requirements?
Options
- AIn the S3 bucket properties, change the default encryption to SSE-S3 with a customer managed
- BIn the S3 bucket properties, change the default encryption to server-side encryption with AWS
- CIn the S3 bucket properties, change the default encryption to server-side encryption with AWS
- DIn the S3 bucket properties, change the default encryption to AES-256 with a customer managed
How the community answered
(50 responses)- A8% (4)
- B80% (40)
- C10% (5)
- D2% (1)
Explanation
SSE-KMS provides the necessary encryption of the PII with customer-managed keys, which the company's security team controls. Setting a bucket policy to deny unencrypted PutObject requests ensures that all future objects in the bucket will be encrypted. Re-uploading all existing objects using the AWS CLI allows for the encryption of the current objects. According to the AWS Certified Solutions Architect -Professional Official Amazon Text Book, SSE-KMS is "a fully managed encryption service that enables you to encrypt your data with keys that you manage."
Community Discussion
No community discussion yet for this question.