Q86 — AWS SAA-C03 Ch.12

Question 86 of 100 | ← Chapter 12

Q886. A company runs an application in the AWS Cloud that generates sensitive archival data files. The company wants to rearchitect the application's data storage. The company wants to encrypt the data files and to ensure that third parties do not have access to the data before the data is encrypted and sent to AWS. The company has already created an Amazon S3 bucket.Which solution will meet these requirements?

Correct Answer: D. Configure the application to use client-side encryption with a key stored in AWS Key Management Service (AWS KMS). Configure the application to store the archival files in the S3 bucket.

Explanation

To meet the requirements of encrypting the data files and ensuring that third parties do not have access to the data before it is encrypted and sent to AWS, the following solution can be implemented:D. Configure the application to use client-side encryption with a key stored in AWS Key Management Service (AWS KMS). Configure the application to store the archival files in the S3 bucket.Client-side encryption involves encrypting the data on the client side before it is uploaded to Amazon S3. By configuring the application to use client-side encryption with a key stored in AWS KMS, the company can ensure that the data is encrypted before it is transmitted to AWS. The encryption key is managed by AWS KMS, providing a secure and scalable solution for protecting sensitive data.Using client-side encryption allows the company to have full control over the encryption process and ensures that only encrypted data is stored in the S3 bucket. This satisfies the requirement of encrypting the data files and preventing third-party access to the data before encryption.Option A suggests configuring the S3 bucket to use client-side encryption with an Amazon S3 managed encryption key. While client-side encryption is the correct approach, using an Amazon S3 managed encryption key does not give the company the desired control over the encryption process. Storing the key in AWS KMS provides better security and management capabilities.Option B suggests configuring the S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS). While server-side encryption provides encryption at rest, it does not address the requirement of encrypting the data before it is transmitted to AWS. Server-side encryption with SSE-KMS is useful for protecting data at rest in S3, but it does not handle the encryption of the data before it reaches the AWS environment.Option C suggests configuring the S3 bucket to use dual-layer server-side encryption with AWS KMS keys (SSE-KMS). Dual-layer server-side encryption is not a valid configuration in Amazon S3. There is no need for a dual-layer encryption approach in this scenario.In summary, to meet the requirements of encrypting the data files and ensuring that third parties do not have access to the data before it is encrypted and sent to AWS, configuring the application to use client-side encryption with a key stored in AWS KMS (Option D) is the appropriate solution.