A company's application runs on Amazon EC2 and stores data in an Amazon S3 bucket . The company wants additional security controls in place to limit the likelihood of accidental exposure of data to…

Question

Options

• AEncrypt the data in Amazon S3 using server-side encryption with Amazon S3 managed
• BEncrypt the data in Amazon S3 using server-side encryption with AWS KMS managed encryption
• CCreate a new Amazon S3 VPC endpoint and modify the VPC's routing tables to use the new
• DUse the Amazon S3 Block Public Access feature.
• EConfigure the bucket policy to allow access from the application instances only
• FUse a NACL to filter traffic to Amazon S3

• A
  10% (3)
• B
  80% (24)
• D
  3% (1)
• F
  7% (2)

Explanation

Using AWS KMS-managed encryption (B) adds a critical access control layer beyond just encrypting data - KMS key policies let you audit and restrict who can decrypt, providing accountability that S3-managed keys (SSE-S3) lack. Creating a VPC endpoint for S3 (C) routes traffic from EC2 instances through the private AWS backbone instead of the public internet, eliminating a path by which data could be intercepted externally, and the endpoint policy can further restrict which buckets are reachable. Restricting the bucket policy to application instances only (E) ensures that even a leaked credential or misconfiguration elsewhere cannot expose data - only the specific EC2 instances are authorized.

Why the others are wrong:

• A (SSE-S3): Encrypts data at rest, but AWS manages the keys entirely with no additional access policy - it adds no meaningful access restriction compared to KMS.
• D (Block Public Access): Prevents public bucket misconfigurations but does not limit access to only the app instances; a misconfigured IAM policy could still expose data to other AWS principals.
• F (NACLs): NACLs control subnet-level traffic within your VPC; S3 is an external managed service, so NACLs cannot filter S3-bound traffic meaningfully - endpoint policies (used with option C) are the correct tool.

Memory tip: Think "KMS + VPC + Policy = Keep Vault Private" - encrypt with control (KMS), route privately (VPC endpoint), and allowlist explicitly (bucket policy).

No community discussion yet for this question.