Q12 — AWS SAA-C03 Ch.14

Question 12 of 100 | ← Chapter 14

Q1012. A company regularly uploads confidential data to Amazon S3 buckets for analysis.The company's security policies mandate that the objects must be encrypted at rest. The company must automatically rotate the encryption key every year. The company must be able to track key rotation by using AWS CloudTrail. The company also must minimize costs for the encryption key.Which solution will meet these requirements?

Correct Answer: D. Use server-side encryption with customer managed AWS KMS keys

Explanation

C OR D.To meet the requirements for encrypting confidential data in Amazon S3 buckets, while ensuring automatic key rotation, tracking via AWS CloudTrail, and minimizing costs, the best solution is:D. Use server-side encryption with customer managed AWS KMS keys.Explanation:\1. Encryption at Rest: Using AWS KMS (Key Management Service) allows for strong encryption of data at rest in S3.\2. Automatic Key Rotation: Customer managed KMS keys can be configured to automatically rotate every year, fulfilling the company's requirement for annual key rotation.\3. Tracking Key Rotation: AWS CloudTrail can log all KMS key management operations, including key rotation, allowing the company to track compliance with security policies.\4. Cost Management: While KMS incurs costs, using customer managed keys allows the company to optimize these costs compared to AWS managed keys, which do not offer the same level of control.Evaluation of Other Options:A. Use server-side encryption with customer-provided keys (SSE-C): This requires manual management of the encryption keys and does not support automatic rotation or CloudTrail tracking, leading to higher operational overhead.B. Use server-side encryption with Amazon S3 managed keys (SSE-S3): This option provides encryption at rest, but the keys are managed by AWS, meaning there is no control over key rotation or detailed tracking.C. Use server-side encryption with AWS KMS keys (SSE-KMS): While this option provides encryption and tracking, AWS managed keys do not allow users to rotate keys automatically.Conclusion:Option D provides the best combination of security, control, compliance, and cost-effectiveness for managing encryption keys for confidential data in Amazon S3.