ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Using server-side encryption with AWS KMS protects the objects at rest and satisfies the confidentiality requirement without changing application code. A resource-based S3 bucket policy that grants GetObject permissions solely to the fraud-analysis application's IAM role enforces least-privilege access. Enabling AWS CloudTrail data events for the bucket records every object-level API call (such as GetObject, PutObject, DeleteObject) in a central audit trail that the security team can query. The other options either do not provide object-level auditing (VPC Flow Logs, CloudWatch metrics), grant broader access than necessary, fail to encrypt data at rest, or introduce higher operational overhead (managing EBS volumes or Glacier workflows), so they do not meet all stated privacy requirements as effectively.