SAP-C02 Q51 · Security

Question

A health insurance company stores personally identifiable information (PII) in an Amazon S3 bucket. The company uses server-side encryption with S3 managed encryption keys (SSE-S3) to encrypt the objects. According to a new requirement, all current and future objects in the S3 bucket must be encrypted by keys that the company’s security team manages. The S3 bucket does not have versioning enabled. Which solution will meet these requirements?

Accepted Answer

**Answer B is correct for these reasons:**

1. **SSE-KMS provides key management by the security team**: SSE-KMS allows the company to use AWS KMS keys (either AWS managed or customer managed CMKs). The security team can create, rotate, disable, and audit these keys through KMS, satisfying the requirement that 'the company's security team manages' the keys.

2. **Changing default encryption**: Setting the default encryption to SSE-KMS ensures all **future** objects uploaded without explicit encryption headers will automatically be encrypted with the specified KMS key.

3. **S3 bucket policy to deny unencrypted PutObject requests**: This is a critical enforcement layer. The bucket policy denies any PutObject that doesn't include the `x-amz-server-side-encryption: aws:kms` header, ensuring n

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips