SAP-C02 · Question #808
A company stores application data in many Amazon S3 buckets in one AWS account. Some of the S3 buckets contain sensitive data. The company does not have data inventory for the S3 buckets. The…
The correct answer is C. Use Amazon Made to determine which S3 buckets contain sensitive data. Create a new AWS. Amazon Macie can help identify sensitive data in S3 buckets. By creating a new AWS KMS customer-managed key (SSE-KMS), you can ensure that only administrators have access to the key through a specific key policy. Setting the default encryption for S3 buckets to use this KMS key…
Question
A company stores application data in many Amazon S3 buckets in one AWS account. Some of the S3 buckets contain sensitive data. The company does not have data inventory for the S3 buckets. The company uses server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt all data in the S3 buckets. A solutions architect must design a solution to encrypt sensitive data with a key that only administrators can access. Which solution will meet these requirements?
Options
- AUse Amazon Inspector to determine which S3 buckets contain sensitive data. Create a new AWS
- BUse Amazon Inspector to determine which S3 buckets contain sensitive data. Update the key
- CUse Amazon Made to determine which S3 buckets contain sensitive data. Create a new AWS
- DUse Amazon Macie to determine which S3 buckets contain sensitive data. Update the key policy
How the community answered
(23 responses)- A9% (2)
- B4% (1)
- C70% (16)
- D17% (4)
Explanation
Amazon Macie can help identify sensitive data in S3 buckets. By creating a new AWS KMS customer-managed key (SSE-KMS), you can ensure that only administrators have access to the key through a specific key policy. Setting the default encryption for S3 buckets to use this KMS key ensures that new data is encrypted with the key. Using an AWS Step Functions workflow to encrypt existing objects ensures that all existing sensitive data is encrypted with the new KMS
Community Discussion
No community discussion yet for this question.