AWS Certified Developer Associate DVA-C02 Practice Question
A developer is designing a new application that processes sensitive financial data. The application will store processed data in Amazon S3. For compliance reasons, the data must be encrypted at all times. Which type of encryption should the developer use to ensure that the data is encrypted before it leaves the application's host and remains encrypted in transit and at rest within Amazon S3?
Implement client-side encryption using a customer-managed key prior to uploading the data to Amazon S3.
Enable Secure Socket Layer (SSL) on the application's server and rely on S3 bucket policies to handle encryption.
Activate default S3 bucket encryption with an AWS Key Management Service (KMS) managed key.
Use server-side encryption with Amazon S3 managed keys (SSE-S3) when uploading the data.
Client-side encryption is the correct approach because it meets the requirement to encrypt data before it leaves the application's host. By encrypting the data on the client side, it is protected prior to transmission, during transit to Amazon S3, and while at rest in the S3 bucket.
Server-side encryption options, such as Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) or with AWS KMS keys (SSE-KMS), are incorrect because the encryption occurs on the AWS side after the data is received by Amazon S3. This does not fulfill the requirement to have the data encrypted before it leaves the application environment.
Using only Secure Socket Layer (SSL)/Transport Layer Security (TLS) is insufficient. While SSL/TLS encrypts data in transit, it does not encrypt the data on the host before it is sent or keep it encrypted at rest within the S3 bucket; server-side encryption would still be required for encryption at rest.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is client-side encryption and how does it work?
Open an interactive chat with Bash
What are the differences between client-side encryption and server-side encryption?
Open an interactive chat with Bash
What are AWS Key Management Service (KMS) managed keys and how are they used?
Open an interactive chat with Bash
AWS Certified Developer Associate DVA-C02
Security
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access