DEA-C01 practice question: Encryption and masking (2 of 2)
Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A healthcare-analytics company's partners upload extracts to an Amazon S3 bucket with their own tools, and a few older systems still send requests over plain HTTP. The company's security policy requires that all data in transit to the bucket be encrypted, and the bucket is already encrypted at rest with SSE-KMS.
The company has told partners to use HTTPS, and it wants the bucket itself to reject any request that is not encrypted in transit.
Which change meets this requirement?
Choose one answer.
AA. Add a bucket policy that denies all s3:* actions when the aws:SecureTransport condition key is false, so that only HTTPS requests are accepted.
BB. Turn on default SSE-KMS encryption for the bucket, which already protects the data at rest and so covers requests made over HTTP.
CC. Put the bucket behind an Amazon CloudFront distribution that accepts HTTP and forwards requests to S3 over HTTPS.
DD. Create a security group that allows only port 443 to the bucket, and attach it to the partners' networks.
Show the answer and explanation
Answer: A
A. Right: Correct. The aws:SecureTransport condition key is true only for requests made over TLS. A bucket policy that denies requests when it is false rejects plain HTTP, while partner tools that use HTTPS keep working. Learn more: Security best practices for Amazon S3 (opens in a new tab)
B. Wrong: Encryption at rest protects the stored objects, but it does not secure the requests that carry data to the bucket. Plain HTTP requests would still be accepted, which the policy forbids.
C. Wrong: A CloudFront distribution that accepts HTTP would still let plain HTTP requests in from the partners. The option does not stop the requests the policy forbids.
D. Wrong: Security groups apply to resources in a VPC, not to S3 bucket requests, and partners' networks are outside the company's VPC. The option does not control requests to the bucket.
Explanation
Encryption at rest and encryption in transit are separate controls. The aws:SecureTransport condition key is true only for TLS requests, so a bucket policy that denies requests when it is false rejects plain HTTP while the partners' HTTPS tools keep working. SSE-KMS, a CloudFront front end and security groups do not stop plain HTTP requests to the bucket.
Want more on Encryption and masking? The 5 full-length practice sets have 7 more Encryption and masking questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →