Q50 — AWS SAA-C03 Ch.15

Question 50 of 100 | ← Chapter 15

Q1150. A company is planning to migrate customer records to an Amazon S3 bucket. The company needs to ensure that customer records are protected against unauthorized access and are encrypted in transit and at rest. The company must monitor all access to the S3 bucket.What solution will meet these requirements with the LEAST operational overhead?

Correct Answer: A. Use AWS Key Management Service (AWS KMS) to encrypt customer records at rest. Create an S3 bucket policy that includes the aws:SecureTransport condition. Use an IAM policy to control access to the records. Use AWS CloudTrail to monitor access to the records.

Explanation

To meet the requirements of protecting customer records in Amazon S3 with least operational overhead, let's evaluate the options:Key Requirements:Encryption in transit and at rest.Protection against unauthorized access (access control).Monitor all access to the S3 bucket.Least operational overhead (simplicity and ease of management).Option Analysis:A. Use AWS KMS to encrypt customer records at rest. Create an S3 bucket policy that includes the aws:SecureTransport condition. Use an IAM policy to control access to the records. Use AWS CloudTrail to monitor access to the records.Encryption at rest: AWS KMS is used (manageable but slightly more overhead than SSE-S3). Encryption in transit: The aws:SecureTransport condition in the bucket policy enforces HTTPS (TLS) for all S3 requests.Access control: IAM policies are used (standard practice). Monitoring: CloudTrail logs all API calls to S3 (no additional setup beyond enabling it). Operational overhead: Moderate (KMS requires key management, but CloudTrail is straightforward to enable).B. Use AWS Nitro Enclaves to encrypt customer records at rest. Use AWS KMS to encrypt the records in transit. Use an IAM policy to control access to the records. Use AWS CloudTrail and AWS Security Hub to monitor access to the records.Nitro Enclaves are not designed for S3 encryption at rest (they are for secure processing of sensitive data in EC2 instances). This is not a valid solution for S3 encryption. Operational overhead: High (Nitro Enclaves are complex to set up and not needed here). C. Use AWS KMS to encrypt customer records at rest. Create an Amazon Cognito user pool to control access to the records. Use AWS CloudTrail to monitor access to the records. Use Amazon GuardDuty to detect threats.Cognito user pools are not typically used for S3 access control (they are for web/mobile app authentication). IAM policies are the standard way to control S3 access. Operational overhead: Higher than necessary (Cognito adds complexity for this use case). D. Use server-side encryption with Amazon S3 managed keys (SSE-S3) with default settings to encrypt the records at rest. Access the records by using an Amazon CloudFront distribution that uses the S3 bucket as the origin. Use IAM roles to control access to the records. Use Amazon CloudWatch to monitor access to the records.SSE-S3 is the simplest way to encrypt data at rest with minimal overhead (no key management required). CloudFront is not needed for basic S3 access control or encryption (it adds complexity unless specifically required for caching or other reasons).CloudWatch does not natively monitor S3 access (CloudTrail is the correct tool for this). Operational overhead: Lower than options using KMS or Cognito, but the CloudFront and CloudWatch parts are unnecessary or incorrect for this use case.Best Solution (Least Operational Overhead):The best option is A, but with a slight adjustment: SSE-S3 (instead of KMS) would further reduce operational overhead for encryption at rest. However, since A is the closest to a correct and low-overhead solution among the given options, here's why it stands out:KMS is manageable for encryption at rest (though SSE-S3 is simpler, KMS is not overly complex). aws:SecureTransport condition ensures HTTPS (encryption in transit). IAM policies and CloudTrail are standard and straightforward for access control and monitoring.However, D is incorrect because:CloudFront is not needed here (unless caching is explicitly required, which is not mentioned).CloudWatch does not monitor S3 access (CloudTrail does).Revised Correct Answer (if SSE-S3 were an option in a better-phrased choice):If the options were more aligned with best practices, the ideal would be:Use SSE-S3 for at-rest encryption (no key management).Enforce HTTPS (aws:SecureTransport).Use IAM for access control.Use CloudTrail for monitoring.But among the given options, A is the closest to correct, despite its slightly higher overhead than SSE-S3.Final Answer (from given options):A. Use AWS Key Management Service (AWS KMS) to encrypt customer records at rest. Create an S3 bucket policy that includes the aws:SecureTransport condition. Use an IAM policy to control access to the records. Use AWS CloudTrail to monitor access to the records.This is the best available option, though in practice, SSE-S3 would be preferred for at-rest encryption if it were an option in a more ideal set of choices.The solution that meets the requirements for protecting customer records with the least operational overhead is:A. Use AWS Key Management Service (AWS KMS) to encrypt customer records at rest. Create an S3 bucket policy that includes the aws:SecureTransport condition. Use an IAM policy to control access to the records. Use AWS CloudTrail to monitor access to the records.AWS KMS: Provides managed encryption for data at rest, ensuring security with minimal configuration. S3 Bucket Policy with aws:SecureTransport: This condition ensures that all data is encrypted in transit by requiring HTTPS.IAM Policy: Allows fine-grained control over who can access the records. AWS CloudTrail: Monitors and logs all access to the S3 bucket, providing an audit trail for security compliance.This approach effectively secures customer records while minimizing ongoing management and operational overhead.