A Company Will Store Sensitive Documents in Three Amazon S3

question 14

Multiple Choice

A company will store sensitive documents in three Amazon S3 buckets based on a data classification scheme of "Sensitive," "Confidential," and "Restricted." The security solution must meet all of the following requirements: Each object must be encrypted using a unique key. Items that are stored in the "Restricted" bucket require two-factor authentication for decryption. AWS KMS must automatically rotate encryption keys annually. Which of the following meets these requirements?

• A) Create a Customer Master Key (CMK) for each data classification type, and enable the rotation of it annually. For the "Restricted" CMK, define the MFA policy within the key policy. Use S3 SSE-KMS to encrypt the objects.
• B) Create a CMK grant for each data classification type with EnableKeyRotation and MultiFactorAuthPresent set to true. S3 can then use the grants to encrypt each object with a unique CMK.
• C) Create a CMK for each data classification type, and within the CMK policy, enable rotation of it annually, and define the MFA policy. S3 can then create DEK grants to uniquely encrypt each object within the S3 bucket.
• D) Create a CMK with unique imported key material for each data classification type, and rotate them annually. For the "Restricted" key material, define the MFA policy in the key policy. Use S3 SSE-KMS to encrypt the objects.

---

Definitions:

Recognizance

A legal obligation, acknowledged before a court, where an individual promises to adhere to certain conditions without the need for posting bail.

Acknowledges

The act of recognizing or admitting the existence or truth of something, often formally in writing.

Specified Act

An action precisely described or defined within a legal document or law.

Executory

Describes a contract or lease that has not yet been fully performed or completed by all parties involved.