Q66 — AWS SAA-C03 Ch.11

Question 66 of 100 | ← Chapter 11

Q766. A company stores sensitive data in Amazon S3. A solutions architect needs to create an encryption solution. The company needs to fully control the ability of users to create, rotate, and disable encryption keys with minimal effort for any data that must be encrypted.Which solution will meet these requirements?

Correct Answer: B. Create a customer managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS).

Explanation

To meet the requirements of fully controlling the ability to create, rotate, and disable encryption keys for sensitive data in Amazon S3 with minimal effort, the most suitable solution is:B. Create a customer managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS).Option B provides the desired solution:Create a customer managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS):\1. AWS Key Management Service (AWS KMS): AWS KMS allows you to create and manage encryption keys to protect sensitive data. By creating a customer managed key, you have full control over the key's lifecycle, including the ability to create, rotate, and disable keys as needed.\2. Server-Side Encryption with AWS KMS keys (SSE-KMS): Enable server-side encryption on the S3 objects using the customer managed key created in AWS KMS. SSE-KMS provides an additional layer of security by encrypting the data at rest using the customer managed key.Here's why the other options are not the most suitable choices:Option A suggests using default server-side encryption with Amazon S3 managed encryption keys (SSE-S3) to store the sensitive data. While this option provides encryption, it does not offer the same level of control and flexibility as using customer managed keys with AWS KMS.Option C suggests creating an AWS managed key in AWS KMS. However, AWS managed keys do not provide the same level of control as customer managed keys. Additionally, the requirement states that the company needs to fully control the ability to create, rotate, and disable encryption keys.Option D suggests downloading the S3 objects to an EC2 instance, encrypting them using customer managed keys, and uploading the encrypted objects back to S3. This approach adds unnecessary complexity and introduces additional steps for encryption and decryption, which may not be efficient or practical.Therefore, the most appropriate solution to fully control the ability to create, rotate, and disable encryption keys for sensitive data in Amazon S3 with minimal effort is B: Create a customer managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS).