ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Server-side encryption with AWS KMS ensures confidentiality because Amazon S3 automatically encrypts each object at rest with an AWS-managed customer master key, removing the need for the team to manage encryption processes or keys. Requiring clients to calculate and send an SHA-256 checksum with each PUT request, and storing that checksum in the object's metadata, allows the application to recalculate and compare the hash whenever the object is retrieved, providing a reliable means to detect any unauthorized modification. The bucket remains private by default, further protecting PHI. Making the bucket public would violate confidentiality, so the shared-secret option is unsuitable. Relying only on versioning and CloudTrail leaves data unencrypted, breaching HIPAA requirements. Using client-side RSA encryption shifts key-management overhead to the startup and ETag values cannot be trusted for integrity on multipart uploads. Therefore, enabling SSE-KMS plus SHA-256 checksums is the only option that delivers both confidentiality and integrity with low operational burden.