Q2 — AWS SAA-C03 Ch.12

Question 2 of 100 | ← Chapter 12

Q802. A company migrated millions of archival files to Amazon S3. A solutions architect needs to implement a solution that will encrypt all the archival data by using a customer-provided key. The solution must encrypt existing unencrypted objects and future objects.Which solution will meet these requirements?

• A. Create a list of unencrypted objects by filtering an Amazon S3 Inventory report. Configure an S3 Batch Operations job to encrypt the objects from the list with a server-side encryption with a customer- provided key (SSE-C). Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C). ✓
• B. Use S3 Storage Lens metrics to identify unencrypted S3 buckets. Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
• C. Create a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure an AWS Batch job to encrypt the objects from the list with a server-side encryption with AWS KMS keys (SSE-KMS). Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
• D. Create a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).

Correct Answer: A. Create a list of unencrypted objects by filtering an Amazon S3 Inventory report. Configure an S3 Batch Operations job to encrypt the objects from the list with a server-side encryption with a customer- provided key (SSE-C). Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).

Explanation

To meet the requirements of encrypting all existing unencrypted objects and future objects in Amazon S3 using a customer-provided key, the recommended solution is:A. Create a list of unencrypted objects by filtering an Amazon S3 Inventory report. Configure an S3 Batch Operations job to encrypt the objects from the list with a server-side encryption with a customer-provided key (SSE-C). Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).Option A provides a comprehensive solution for encrypting both existing unencrypted objects and future objects with a customer-provided key (SSE-C):\1. Creating a list of unencrypted objects by filtering an Amazon S3 Inventory report allows identification of the existing unencrypted objects.\2. Configuring an S3 Batch Operations job to encrypt the objects from the list with SSE-C enables bulk encryption of the existing unencrypted objects.\3. Configuring the S3 default encryption feature to use SSE-C ensures that all future objects uploaded to S3 are automatically encrypted with the customer-provided key.Here's why the other options are not the best fit for the given requirements:B. Using S3 Storage Lens metrics to identify unencrypted S3 buckets and configuring the S3 default encryption feature to use SSE-KMS: This option only addresses the encryption of buckets, not individual objects. It does not provide a solution for encrypting existing unencrypted objects, and it does not allow for the use of a customer-provided key.C. Creating a list of unencrypted objects by filtering the AWS usage report for Amazon S3 and configuring an AWS Batch job to encrypt the objects with SSE-KMS: The AWS usage report is not designed for identifying unencrypted objects within S3. Additionally, using an AWS Batch job adds unnecessary complexity for the encryption process. This option also does not allow for the use of a customer-provided key.D. Creating a list of unencrypted objects by filtering the AWS usage report for Amazon S3 and configuring the S3 default encryption feature to use SSE-C: Similar to option C, the AWS usage report is not intended for identifying unencrypted objects within S3. Additionally, this option does not provide a solution for encrypting existing unencrypted objects.Therefore, the recommended solution that meets the requirements of encrypting all existing unencrypted objects and future objects in Amazon S3 using a customer-provided key is:A. Create a list of unencrypted objects by filtering an Amazon S3 Inventory report. Configure an S3 Batch Operations job to encrypt the objects from the list with a server-side encryption with a customer-provided key (SSE-C). Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).