A Company Has Decided to Migrate Sensitive Documents from On-Premises

question 236

Multiple Choice

A company has decided to migrate sensitive documents from on-premises data centers to Amazon S3. Currently, the hard drives are encrypted to meet a compliance requirement regarding data encryption. The CISO wants to improve security by encrypting each file using a different key instead of a single key. Using a different key would limit the security impact of a single exposed key. Which of the following requires the LEAST amount of configuration when implementing this approach?

• A) Place each file into a different S3 bucket. Set the default encryption of each bucket to use a different AWS KMS customer managed key.
• B) Put all the files in the same S3 bucket. Using S3 events as a trigger, write an AWS Lambda function to encrypt each file as it is added using different AWS KMS data keys.
• C) Use the S3 encryption client to encrypt each file individually using S3-generated data keys
• D) Place all the files in the same S3 bucket. Use server-side encryption with AWS KMS-managed keys (SSE-KMS) to encrypt the data

---

Definitions:

Right Kinds

Refers to the specific categories or types that are considered appropriate or most suited for a certain context or purpose.

Evidence

Information or signs that support the truth or validity of a belief, argument, or claim.

Testimonial

A formal statement or written declaration testifying to someone's character, qualifications, or the quality of a product or service.

Modest Persona

A representation or character that displays humility and does not seek excessive attention, often used in literary or theatrical contexts to depict virtue.