Q11 — AWS SAA-C03 Ch.17

Question 11 of 89 | ← Chapter 17

Q1311. A solutions architect is storing sensitive data generated by an application in Amazon S3. The solutions architect wants to encrypt the data at rest. A company policy requires an audit trail of when the AWS KMS key was used and by whom.Which encryption option will meet these requirements?

• A. Server-side encryption with Amazon S3 managed keys(SSE-S3)
• B. Server-side encryption with AWS KMS managed keys(SSE-KMS) ✓
• C. Server-side encryption with customer-provided keys(SSE-C)
• D. Server-side encryption with self-managed keys

Correct Answer: B. Server-side encryption with AWS KMS managed keys(SSE-KMS)

Explanation

Requirement recap- Encrypt the S3 objects at rest- Must be able to produce an audit trail that shows who used the key and when****Evaluation of choicesA. SSE-S3?Keys are owned/managed by AWS; no CloudTrail visibility into key usage.?No audit trail reject.B. SSE-KMS?Keys live in AWS KMS; every encrypt/decrypt is an API call to KMS. ?KMS activity is logged to CloudTrail with caller identity, timestamp, key ARN, operation.?Gives the required audit trail choose.C. SSE-C?Customer sends the key with each request; S3 never stores it. ?No KMS, no CloudTrail, no record of "who used the key" reject.D. "Self-managed keys" (SSE-C alias)?Same as C; still no AWS-side audit reject.