Q79 — AWS SAA-C03 Ch.15

Question 79 of 100 | ← Chapter 15

Q1179. A company plans to store sensitive user data on Amazon S3. Internal security compliance requirement mandate encryption of data before sending it to Amazon S3.What should a solutions architect recommend to satisfy these requirements?

Correct Answer: D. Client-side encryption with a key stored in AWS Key Management Service (AWS KMS)

Explanation

To satisfy the internal security compliance requirement of encrypting sensitive user data before sending it to Amazon S3, the solutions architect should recommend D. Client-side encryption with a key stored in AWS Key Management Service (AWS KMS).Analysis of Options:Option A: Server-side encryption with customer-provided encryption keys (SSE-C) Limitation: SSE-C involves the customer providing the encryption key to Amazon S3 when uploading data, and S3 uses this key to encrypt the data server-side. However, the encryption happens after the data is sent to S3, which does not meet the requirement of encrypting the data before sending it to S3. Option B: Client-side encryption with Amazon S3 managed encryption keys Limitation: Amazon S3 does not manage encryption keys for client-side encryption. Client-side encryption requires the customer to manage the encryption keys themselves or use AWS KMS. Therefore, this option is not valid because S3 does not provide managed encryption keys for client-side encryption. Option C: Server-side encryption with keys stored in AWS Key Management Service (AWS KMS) (SSE- KMS)Limitation: SSE-KMS involves Amazon S3 encrypting the data server-side using a key stored in AWS KMS. Similar to SSE-C, the encryption happens after the data is sent to S3, which does not meet the requirement of encrypting the data before sending it to S3.Option D: Client-side encryption with a key stored in AWS Key Management Service (AWS KMS) Advantage: Client-side encryption involves encrypting the data before it is sent to Amazon S3. The customer can use the AWS KMS SDK to generate or retrieve a data key from AWS KMS, encrypt the data using this key, and then upload the encrypted data to S3. This meets the requirement of encrypting the data before sending it to S3, and AWS KMS provides secure key management.Conclusion:D. Client-side encryption with a key stored in AWS Key Management Service (AWS KMS) is the correct recommendation to satisfy the internal security compliance requirement of encrypting sensitive user data before sending it to Amazon S3. This approach ensures that the data is encrypted at the client side before being transmitted to S3, and AWS KMS provides secure key management for the encryption keys.