SAP-C02 Question #311: Real Exam Question with Answer & Explanation

Question

A media company is serving video files stored in Amazon S3 using Amazon CloudFront. The development team needs access to the logs to diagnose faults and perform service monitoring. The log files from CloudFront may contain sensitive information about users. The company uses a log processing service to remove sensitive information before making the logs available to the development team. The company has the following requirements for the unprocessed logs: - The logs must be encrypted at rest and must be accessible by the log processing service only. - Only the data protection team can control access to the unprocessed log files. - AWS CloudFormation templates must be stored in AWS CodeCommit. - AWS CodePipeline must be triggered on commit to perform updates made to CloudFormation templates. - CloudFront is already writing the unprocessed logs to an Amazon S3 bucket, and the log processing service is operating against this S3 bucket. Which combination of steps should a solutions architect take to meet the company's requirements? (Choose two.)

Options

• ACreate an AWS KMS key that allows the AWS Logs Delivery account to generate data keys for
• BCreate an AWS KMS key that follows the CloudFront service role to generate data keys for
• CConfigure S3 default encryption to use AWS KMS managed keys (SSE-KMS) on the log storage
• DCreate a new CodeCommit repository for the AWS KMS key template.
• EUse the existing CodeCommit repository for the AWS KMS key template.