Exam AWS Certified Solutions Architect - Associate SAA-C02 topic 1 question 52 discussion

Answer is D Explanation: SSE-S3: AWS manages both data key and master key SSE-KMS: AWS manages data key and you manage master key SSE-C: You manage both data key and master key

D is correct. C & D are the same with the exception of D allowing for role separation and controlling access to the keys.

need KMS so D

Ans -D With AWS managed KMS, you can manage the access of keys.

Answer is D

You gotta need KMS for controlling access

D. AT rest in S3 ----> KMS

Answer is D Because if u want to control access of the keys, then u must use sse kms iam authorisation feature. This feature is not available in S3.

Explanation: SSE-KMS requires that AWS manage the data key but you manage the customer master key (CMK) in AWS KMS. You can choose a customer managed CMK or the AWS managed CMK for Amazon S3 in your account. Customer managed CMKs are CMKs in your AWS account that you create, own, and manage. You have full control over these CMKs, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, rotating their cryptographic material, adding tags, creating aliases that refer to the CMK, and scheduling the CMKs for deletion. For this scenario, the solutions architect should use SSE-KMS with a customer managed CMK. That way KMS will manage the data key but the company can configure key policies defining who can access the keys. CORRECT: "Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)" is the correct answer.

There are 4 methods of encrypting objects in S3 • SSE-S3: encrypts S3 objects using keys handled & managed by AWS • SSE-KMS: leverage AWS Key Management Service to manage encryption keys • SSE-C: when you want to manage your own encryption keys • Client Side Encryption

D. Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)

D is correct

D is correct as as Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) helps define encryption using customer managed keys. Customer-managed keys are controlled by a user who can decide when to rotate, revoke, or delete them. Moreover, accessing and using the keys can be restricted; each key is wrapped with a policy that defines which users can execute an operation on it.

it's D

Ans = D SSE-KMS

D right

D is good