Discuss Amazon SAA-C03 Exam Topic 4 Question 71

A company needs to store confidential files on AWS. The company accesses the files every week. The company must encrypt the files by using envelope encryption, and the encryption keys must be rotated automatically. The company must have an audit trail to monitor encryption key usage.

Which combination of solutions will meet these requirements? (Select TWO.)

AStore the confidential files in Amazon S3.

BStore the confidential files in Amazon S3 Glacier Deep Archive.

CUse server-side encryption with customer-provided keys (SSE-C).

DUse server-side encryption with Amazon S3 managed keys (SSE-S3).

EUse server-side encryption with AWS KMS managed keys (SSE-KMS).

Suggested Answer: A, E

Amazon S3 is suitable for storing data that needs to be accessed weekly and integrates with AWS Key Management Service (KMS) to provide encryption at rest with server-side encryption using KMS-managed keys (SSE-KMS).

SSE-KMS uses envelope encryption and allows automatic key rotation and logging through AWS CloudTrail, satisfying the requirements for audit trails and compliance.

S3 Glacier Deep Archive is unsuitable due to its high retrieval latency. SSE-C requires customer-side management of encryption keys, with no support for automatic rotation or audit. SSE-S3 does not use customer-managed keys and lacks fine-grained control and auditing.

Get Premium SAA-C03 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Ana Berg 15 days ago

Going with D since SSE-S3 uses S3 managed keys and lacks auditing, and the tricky part is envelope encryption with automatic rotation, which SSE-KMS provides.

Desmond 3 months ago

I’m not sure about A. What if we need long-term storage? B could be better.

Freeman 3 months ago

Agreed! E ensures automatic key rotation and audit trails.

Jovita 4 months ago

I think A and E are the best choices. S3 is perfect for storage.

Fatima 4 months ago

SSE-KMS is the way to go for audit trails!

Domingo 4 months ago

Wait, can you really automate key rotation with SSE-S3?

Cecily 4 months ago

I agree, A and E seem to fit perfectly!

Lorrie 6 months ago

I think B is a bad choice here, too slow for weekly access.

Bettina 6 months ago

Definitely A and E for this scenario.

Florinda 7 months ago

I feel like SSE-S3 is simpler but might not provide the audit trail we need. I’m leaning towards SSE-KMS for that reason.

Naomi 7 months ago

I practiced a similar question where SSE-KMS was the right choice for automatic key rotation. I think it’s definitely one of the answers here.

Wayne 7 months ago

I’m a bit unsure about the storage options. I know S3 is good for frequent access, but does Glacier Deep Archive meet the access requirement?

In 7 months ago

I remember that envelope encryption involves using a data key to encrypt the files and then encrypting that data key with a master key. I think AWS KMS is the way to go for managing those keys.

Amazon SAA-C03 Exam - Topic 4 Question 71 Discussion