Exam AWS Certified Data Analytics - Specialty topic 1 question 109 discussion

I think D is right answer

A business owns an Amazon Redshift cluster that is encrypted. The organization just enabled audit logs in Amazon Redshift and wants to guarantee that audit logs are likewise encrypted at rest. The logs are kept for one year. The auditor conducts a monthly audit of the logs. How might these needs be met in the MOST cost-effective manner possible? D is the best answer. We want to have our logs in S3 and be able to query them. Using the S3 encryption is enough for our security requirements. Now, the logs are audited once a month, meaning we need to extract meaningful information from them. We already have a Redshift cluster, so using spectrum is a bliss for this task.

D: I passed the test

A can't be correct because of the following: "Currently, you can only use Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging." https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-logs Hence, D is the right answer.

Correct answer is D as S3 default encryption helps data at rest encryption. As the logs are queried once a month, it would be cost-effective to store the data in S3 and have it queried using Redshift Spectrum. Options A & C are wrong as loading the data in Redshift would result in the most cost-effective solution. Option B is wrong as Redshift Audit logs are stored in S3.

Option C. AES 256 - Free, S3 select can query the data directly. Instead KMS additional cost and Spectrum needs cluster, costly.

I doubt that D is the most cost effective answer since it involves expensive "Amazon Redshift Spectrum". Guys this is an additional cost as given in "https://docs.aws.amazon.com/redshift/latest/dg/c-getting-started-using-spectrum.html". Its original purpose is to query exabytes of data resides in S3 without loading to Redshift. But copying an audit log will be of no cost compared to that, coz its small in size. So I guess it should be A. We can use copy command to load data and its capable of automatically decrypting data in S3 while copying.

It is D! AWS KMS is more expensive then using the default SSE-S3 (using AES-256). Loading the logs into Redshift Cluster is more expensive then querying the logs via Redshift Spectrum.

D. As CHRIS12722222 commented: "Currently, you can only use Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging."

AES-256 not supported

No need to COPY the data into Redshift. You can use Redshift Spectrum to query the data in S3 since it is used monthly only.

Answer is D

D https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html

ans is D

D is the correct answer as auditor is only looking to query data once a month. Data can stay on s3.