SCS-C03 practice question: Encryption at rest (KMS, CloudHSM, server-side and client-side encryption)

Data Protection A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A clinical research company stores trial datasets in Amazon S3. A regulator now requires two independent layers of server-side encryption for the trial-results bucket, using keys that the company controls. The company also needs a CloudTrail record of each decryption of the data in its other buckets, showing which principal used which key.

The other buckets hold lower-risk data. The team wants them to need no application changes and no key handling in code. Keys must rotate automatically each year.

Which TWO changes meet these requirements? (Choose two.)

Choose two answers.

A. Set the other buckets to SSE-C, and have each application send the encryption key with every request. Store the keys in the application configuration files, and have a developer rotate them each year.
B. Encrypt each object in the application with a client-side library before upload, using a data key from AWS KMS. Keep the encrypted objects in S3 with the default SSE-S3 setting as well.
C. Keep SSE-S3 on all buckets, and turn on S3 server access logs to record each object read. The access logs will show who read each object and which key was used to decrypt it.
D. Set the default encryption of the trial-results bucket to DSSE-KMS with a customer managed key, so that each object gets two layers of server-side encryption.
E. Set the default encryption of the other buckets to SSE-KMS with S3 Bucket Keys off, using a customer managed key that has automatic rotation turned on.

Show the answer and explanation

Answers: D, E

A. Wrong: With SSE-C, applications must handle the keys and send them on every request, which the team forbids. S3 does not keep the key, and KMS does not log these uses, so the record requirement fails too.
B. Wrong: Client-side encryption requires code changes in every application and key handling in that code. The regulator wants two server-side layers, and client-side encryption does not provide them.
C. Wrong: SSE-S3 keys are managed by S3 and do not produce a record of each decryption. Server access logs record requests, not the key that decrypted each object.
D. Right: Correct. DSSE-KMS applies two layers of encryption, and the customer managed key is used for both, so the regulator rule is met. KMS logs the key use in CloudTrail, and the key can rotate yearly. Learn more: Using dual-layer server-side encryption with AWS KMS keys (opens in a new tab)
E. Right: Correct. With Bucket Keys off, SSE-KMS calls KMS for each object, so every decryption is logged in CloudTrail with the principal and key. The bucket default needs no application change, and the key rotates each year automatically. Learn more: Using server-side encryption with AWS KMS keys (opens in a new tab)

Explanation

DSSE-KMS provides two server-side layers under a customer managed key, and SSE-KMS logs each key use in CloudTrail with no application change. SSE-C and client-side encryption push key handling into applications, and SSE-S3 keeps no per-decryption record. The two correct changes cover the regulated bucket and the lower-risk buckets.

SCS-C03 practice question: Encryption at rest (KMS, CloudHSM, server-side and client-side encryption)

Explanation

Study

Keep practicing