A Media Company Is Serving Video Files Stored in Amazon

question 60

Multiple Choice

A media company is serving video files stored in Amazon S3 using Amazon CloudFront. The development team needs access to the logs to diagnose faults and perform service monitoring. The log files from CloudFront may contain sensitive information about users. The company uses a log processing service to remove sensitive information before making the logs available to the development team. The company has the following requirements for the unprocessed logs: The logs must be encrypted at rest and must be accessible by the log processing service only. Only the data protection team can control access to the unprocessed log files. AWS CloudFormation templates must be stored in AWS CodeCommit. AWS CodePipeline must be triggered on commit to perform updates made to CloudFormation templates. CloudFront is already writing the unprocessed logs to an Amazon S3 bucket, and the log processing service is operating against this S3 bucket. Which combination of steps should a solutions architect take to meet the company's requirements? (Choose two.)

• A) Create an AWS KMS key that allows the AWS Logs Delivery account to generate data keys for encryption Configure S3 default encryption to use server-side encryption with KMS managed keys (SSE-KMS) on the log storage bucket using the new KMS key. Modify the KMS key policy to allow the log processing service to perform decrypt operations.
• B) Create an AWS KMS key that follows the CloudFront service role to generate data keys for encryption Configure S3 default encryption to use KMS managed keys (SSE-KMS) on the log storage bucket using the new KMS key
• C) Configure S3 default encryption to use AWS KMS managed keys (SSE-KMS) on the log storage bucket using the AWS Managed S3 KMS key. Modify the KMS key policy to allow the CloudFront service role to generate data keys for encryption
• D) Create a new CodeCommit repository for the AWS KMS key template. Create an IAM policy to allow commits to the new repository and attach it to the data protection team's users. Create a new CodePipeline pipeline with a custom IAM role to perform KMS key updates using CloudFormation Modify the KMS key policy to allow the CodePipeline IAM role to modify the key policy.
• E) Use the existing CodeCommit repository for the AWS KMS key template. Modify the existing CodePipeline pipeline to use a custom IAM role and to perform KMS key updates using CloudFormation.

---

Definitions:

Bottlenecks

Points of congestion or obstruction in a system that significantly delay or impede its overall function or efficiency.

Customer Value

The understanding of a product or service's value to a customer compared to other available options.

Profitability

The ability of a business to earn a profit, reflected in the difference between its revenue and expenses.

Throughput Accounting

A principle of accounting focusing on the rate at which a system generates money through sales, highlighting production efficiency.