MENU
A company is preparing to store confidential data in Amazon S3 For compliance reasons the data must be encrypted at rest Encryption key usage must be logged tor auditing purposes. Keys must be rotated every year.
Which solution meets these requirements and the MOST operationally efferent?
Suggested Answer: A
Get Premium SAA-C03 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
A) How do you protect your data in transit?
Best Practices:
Implement secure key and certificate management: Store encryption keys and certificates securely and rotate them at appropriate time intervals while applying strict access control; for example, by using a certificate management service, such as AWS Certificate Manager (ACM).
Enforce encryption in transit: Enforce your defined encryption requirements based on appropriate standards and recommendations to help you meet your organizational, legal, and compliance requirements.
Automate detection of unintended data access: Use tools such as GuardDuty to automatically detect attempts to move data outside of defined boundaries based on data classification level, for example, to detect a trojan that is copying data to an unknown or untrusted network using the DNS protocol.
Authenticate network communications: Verify the identity of communications by using protocols that support authentication, such as Transport Layer Security (TLS) or IPsec.
https://wa.aws.amazon.com/wat.question.SEC_9.en.html
40 comments · newest first
FE
Felix
11 months ago
Definitely need logging for compliance, so SSE-KMS is the way to go!
AN
Andree
11 months ago
SSE-C requires more manual work, not efficient.
IR
Irving
11 months ago
Wait, can we really automate key rotation? That’s impressive!
AV
Avery
11 months ago
I think SSE-S3 is easier to manage though.
MA
Marylyn
12 months ago
SSE-KMS with automated rotation sounds solid!
SH
Shawnta
12 months ago
I’m leaning towards option D as well, but I wonder if there are any specific compliance requirements that might make one of the other options more suitable.
LA
Lajuana
1 year ago
I feel like I’ve seen a similar question before, and I think SSE-KMS is generally preferred for compliance, but I’m not sure if it was option C or D that had the automated rotation.
AP
Apolonia
1 year ago
I'm not entirely sure, but I remember something about SSE-C being less operationally efficient because of the need to manage keys manually.
TA
Taryn
1 year ago
I think option D is the best choice since it mentions automated key rotation, which sounds like it would save time and effort.
MI
Mike
1 year ago
I'm a little confused by the different encryption options. Can someone help me understand the differences between SSE-C, SSE-S3, and SSE-KMS? That might help me narrow down the best choice.
DE
Dean
1 year ago
I'm confident that option D is the best choice here. The question specifically asks for the most operationally efficient solution, and automatic key rotation with AWS KMS is the way to go.
GU
Gussie
1 year ago
Okay, let's think this through. We need encryption at rest, logging of key usage, and automatic key rotation. I'm leaning towards option D, which seems to meet all of those requirements.
WI
Willis
1 year ago
This one seems pretty straightforward. I think the key is to focus on the requirements around encryption, key usage logging, and automatic key rotation.
NO
Nobuko
1 year ago
Hmm, I'm a bit unsure about this one. The question mentions a few different encryption options, and I'm not sure which one would be the most operationally efficient.
DO
Dominga
1 year ago
I think the "with sharing" keyword in Apex classes is the way to go. That ensures record visibility is properly enforced.
EL
Elin
1 year ago
This seems like a classic specification-based testing scenario. Since the system is safety-critical, I'd probably go with State Transition Testing to ensure I cover all the possible state changes and transitions.
DE
Derrick
1 year ago
Okay, I've got a plan. I'll focus on the key requirements - the nonprofit wants to use the memberships feature. That means I need to look for an option that directly supports that, like creating a Membership Opportunity record type.
WH
Whitley
1 year ago
I remember practicing a question on this, and I think production planning was involved somehow.
GA
Galen
1 year ago
I'm just glad I don't have to remember to rotate the keys myself. Imagine if they made us do that by carrier pigeon or something. Technology, FTW!
HO
Honey
1 year ago
Exactly! Technology definitely makes our lives easier.
ZO
Zona
1 year ago
That sounds like a lifesaver. No more manual key rotation for us!
JA
James
1 year ago
Use AWS Key Management Service (KMS) to manage encryption keys and enable key rotation
LE
Leah
1 year ago
Wow, these compliance requirements are tougher than my in-laws' expectations. Good thing AWS has solutions to make our lives easier!
PE
Penney
1 year ago
Definitely option D. Who wants to remember to rotate the keys manually every year? AWS KMS with automatic rotation is the way to go. Less headaches, more security.
LE
Leonida
1 year ago
AWS KMS with automatic rotation is a smart choice for ensuring data security and compliance with minimal effort.
ED
Edgar
1 year ago
It's important to have that extra layer of security and automation with AWS KMS for encryption keys.
NO
Noelia
1 year ago
Automatic rotation definitely makes it easier to stay compliant with key rotation requirements.
BO
Bong
1 year ago
I agree, option D with AWS KMS automatic rotation is the best choice for security and efficiency.
JA
Janessa
1 year ago
Hmm, SSE-KMS with manual key rotation? That sounds like a lot of manual work. I'd rather have the system handle it automatically if possible.
CO
Colton
2 years ago
I'd go with option D. Automatic key rotation takes care of the yearly requirement, and the logging feature ensures auditability. Seems like the most operationally efficient choice.
LA
Lavelle
1 year ago
User4: Logging the encryption key usage is crucial for compliance reasons.
BO
Bok
1 year ago
I agree, the logging feature for auditing purposes is also important.
DA
Daryl
1 year ago
Option D sounds like the best choice. Automatic key rotation is convenient.
LO
Loreta
1 year ago
User3: Automatic key rotation definitely simplifies the yearly requirement.
LA
Layla
1 year ago
User2: I agree, it seems like the most operationally efficient solution.
DE
Desmond
1 year ago
User1: Option D sounds like the best choice. Automatic key rotation and logging for auditing purposes.
AL
Alishia
2 years ago
SSE-KMS with automatic key rotation sounds like the perfect solution to meet the compliance requirements and minimize operational overhead. Logging the encryption key usage for auditing is a great feature too.
QU
Quentin
2 years ago
But wouldn't manual rotation give us more control over the encryption keys and auditing purposes?
HO
Hoa
2 years ago
I disagree, I believe D) Server-side encryption with AWS KMS customer master keys with automated rotation is more operationally efficient.
QU
Quentin
2 years ago
I think the best solution is C) Server-side encryption with AWS KMS customer master keys with manual rotation.