Q29 — AWS SAA-C03 Ch.14

Question 29 of 100 | ← Chapter 14

Q1029. A company is migrating an application from an on-premises environment to AWS. The application will store sensitive data in Amazon S3. The company must encrypt the data before storing the data in Amazon S3.Which solution will meet these requirements?

Correct Answer: A. Encrypt the data by using client-side encryption with customer managed keys.

Explanation

To meet the requirement of encrypting sensitive data before storing it in Amazon S3, the best solution is:A. Encrypt the data by using client-side encryption with customer managed keys.Explanation:\1. Client-Side Encryption with Customer Managed Keys: - Client-side encryption allows the company to encrypt the data before it is sent to Amazon S3. This means that the encryption keys are managed by the company, providing full control over the encryption process and the keys used to encrypt the data. This is particularly important for sensitive data, as it ensures that the company maintains ownership and control over the encryption keys.\2. Data Security: - By using client-side encryption, the data is encrypted before it leaves the on-premises environment, which adds an extra layer of security. Even if the data is intercepted during transmission or accessed in S3, it will remain secure and unreadable without the proper decryption keys.Evaluation of Other Options:B. Encrypt the data by using server-side encryption with AWS KMS keys (SSE-KMS): - While SSE-KMS is a strong option and provides good security for data at rest in S3, the company may not have full control over the keys, as they are managed by AWS. This may not meet the requirement for encrypting data before it is stored in S3.C. Encrypt the data by using server-side encryption with customer-provided keys (SSE-C): - SSE-C allows customers to manage their own encryption keys, but it requires that the keys be provided with each request to S3. This can introduce more complexity and operational overhead compared to client-side encryption.D. Encrypt the data by using client-side encryption with Amazon S3 managed keys: - While client-side encryption is a good approach, using Amazon S3 managed keys does not provide the same level of control over the encryption process as using customer-managed keys. The company would not have direct control over the keys used for encryption.Conclusion:Option A is the most suitable solution for encrypting sensitive data before storing it in Amazon S3, as it provides complete control over the encryption process and keys, meeting the company's security requirements effectively.