A company wants to store all objects that contain sensitive data in an Amazon S3 bucket. The company will use server-side encryption to encrypt the S3 bucket. The company's operations team manages…

Question

Options

• AEnsure that the operations team configures default bucket encryption on the S3 bucket to use
• BEnsure that the operations team creates a bucket policy that requires requests to use server-side
• CEnsure that the operations team creates a bucket policy that requires requests to use server-side
• DEnsure that the operations team creates a bucket policy that requires requests to use server-side

• A
  11% (2)
• B
  84% (16)
• D
  5% (1)

Explanation

Using SSE-KMS with customer-managed keys (CMKs) in AWS Key Management Service (KMS) allows the company to separate duties between the operations and security teams effectively. The operations team can enforce bucket policies that require objects to be encrypted with KMS keys, while the security team manages access to the keys through KMS key policies. This setup ensures that the operations team can manage the S3 bucket without access to the encryption keys, and the security team can control access to the keys without managing the bucket directly, fulfilling the company's need for duty separation and reducing the risk of unauthorized access to

No community discussion yet for this question.