A company has a PHP-based web application that uses Amazon S3 as an object store for user files. The S3 bucket is configured for server-side encryption with Amazon S3 managed keys (SSE-S3). New…

Question

Options

• ACreate a new customer managed key in AWS Key Management Service (AWS KMS).
• BChange the SSE-S3 configuration on the S3 bucket to server-side encryption with customer-
• CConfigure the PHP SDK to use the SSE-S3 key before upload.
• DCreate an AWS managed key for Amazon S3 in AWS KMS.
• EChange the SSE-S3 configuration on the S3 bucket to server-side encryption with AWS KMS
• FChange all the S3 objects in the bucket to use the new encryption key.

• A
  80% (53)
• B
  5% (3)
• C
  12% (8)
• D
  3% (2)

Explanation

SSE-S3 uses AWS-managed keys and does not provide customer control. AWS Certified Security - Specialty documentation states that SSE-KMS with customer managed keys allows full control, auditing, and key rotation. The security engineer must first create a customer managed KMS key, then update the bucket to use SSE-KMS. Existing objects must be re-encrypted to ensure compliance. SSE-C requires the application to manage keys, increasing complexity and risk. AWS managed keys do not meet the requirement for customer-controlled encryption.

No community discussion yet for this question.