Q53 — AWS SAA-C03 Ch.14

Question 53 of 100 | ← Chapter 14

Q1053. A medical company wants to perform transformations on a large amount of clinical trial data that comes from several customers. The company must extract the data from a relational database that contains the customer data. Then the company will transform the data by using a series of complex rules. The company will load the data to Amazon S3 when the transformations are complete.All data must be encrypted where it is processed before the company stores the data in Amazon S3. All data must be encrypted by using customer-specific keys.Which solution will meet these requirements with the LEAST amount of operational effort?

• A. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data.
• B. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses client-side encryption with a custom client-side root key (CSE-Custom) to encrypt the data.
• C. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS managed keys (CSE-KMS) to encrypt the data. ✓
• D. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data.

Correct Answer: C. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS managed keys (CSE-KMS) to encrypt the data.

Explanation

To meet the requirements of transforming clinical trial data with customer-specific encryption keys and minimizing operational effort, the best solution is:C. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS managed keys (CSE-KMS) to encrypt the data.Explanation:\1. AWS Glue: - AWS Glue is a fully managed extract, transform, load (ETL) service that simplifies the process of working with large datasets. It requires minimal operational effort compared to managing an entire Amazon EMR cluster.\2. Client-Side Encryption with AWS KMS: - Using client-side encryption with AWS KMS managed keys (CSE-KMS) allows for customer-specific encryption keys, ensuring that each customer's data is encrypted with their unique key. This method provides strong security while maintaining control over the encryption process.\3. Operational Efficiency: - By utilizing AWS Glue, the company can automate the ETL process without the overhead of managing multiple EMR clusters. This reduces complexity and enhances scalability.Evaluation of Other Options:A. Create one AWS Glue job for each customer with SSE-S3: - While AWS Glue is a good choice, using server-side encryption with Amazon S3 managed keys (SSE-S3) does not provide customer-specific keys, which is a requirement.B. Create one Amazon EMR cluster for each customer with CSE-Custom: - This option involves managing multiple EMR clusters, which increases operational overhead. Additionally, client-side encryption with a custom key management approach can complicate the encryption process.D. Create one Amazon EMR cluster for each customer with SSE-KMS: - Although SSE-KMS allows for using customer-specific keys, managing EMR clusters is more complex and requires additional operational effort compared to using AWS Glue.Conclusion:Option C provides an efficient, manageable solution that meets the requirement for transforming data while ensuring customer-specific encryption with minimal operational effort.