QuestionQ244

Data Security and Governance

A company uses a data lake based on an Amazon S3 bucket. To meet regulatory requirements, the company must apply two layers of server-side encryption to files uploaded to the S3 bucket. The company wants an AWS Lambda function to apply the required encryption.

Which solution meets these requirements?

  • A Use both server-side encryption with AWS KMS keys (SSE-KMS) and the Amazon S3 Encryption Client.
  • B Use dual-layer server-side encryption with AWS KMS keys (DSSE-KMS).
  • C Use server-side encryption with customer-provided keys (SSE-C) before files are uploaded.
  • D Use server-side encryption with AWS KMS keys (SSE-KMS).
Explanation

Dual-layer server-side encryption with AWS KMS keys (DSSE-KMS) applies two independent AES-256 encryption layers to Amazon S3 objects at upload time. It is intended for compliance requirements that mandate multilayer server-side encryption.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!