AWS Certified Developer - Associate DVA-C02Demo

By Amazon · Question Mode

QuestionQ25

Security

A developer is storing sensitive data generated by an application in Amazon S3. The developer wants to encrypt the data at rest. A company policy requires an audit trail of when the AWS Key Management Service (AWS KMS) key was used and by whom.

Which encryption option will meet these requirements?

  • A Server-side encryption with Amazon S3 managed keys (SSE-S3)
  • B Server-side encryption with AWS KMS managed keys (SSE-KMS)
  • C Server-side encryption with customer-provided keys (SSE-C)
  • D Server-side encryption with self-managed keys
Explanation

SSE-KMS (Server-Side Encryption with AWS KMS) integrates with CloudTrail to automatically log all key usage, including who used the key and when. This provides the audit trail required by the company policy. SSE-S3 does not support audit trails, SSE-C and self-managed keys do not offer centralized CloudTrail logging, and customer-managed keys require additional operational overhead.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!