Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 965 discussion

For D is the answer...where it says the customer has their owns keys??? Here it is the explanation... Client-side encryption with Amazon S3 involves encrypting data on the client-side (your application) before uploading it to Amazon S3. This provides an extra layer of security as the data is encrypted before it ever leaves your control. When using S3 managed keys for client-side encryption, the key material and encryption key are managed by AWS, but the encryption process itself is handled by the S3 Encryption Client within your application

Question is unclear. "before" store= before send api or before save?

To meet the requirement of encrypting sensitive data before storing it in Amazon S3, the company should use Server-Side Encryption with Customer-Provided Keys (SSE-C) or Client-Side Encryption. However, the most common and effective approach in AWS is Server-Side Encryption with AWS Key Management Service (SSE-KMS).

If the answer is B, how will the data be encrypted before being stored in Amazon S3? It has to be client-side encryption.

AWS handles the encryption and decryption process, simplifying the management of encryption keys.

Correct is A

Before you store the data in S3 you can use client side encryption