Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 255 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 255
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A company wants to store all objects that contain sensitive data in an Amazon S3 bucket. The company will use server-side encryption to encrypt the S3 bucket. The company’s operations team manages access to the company’s S3 buckets. The company’s security team manages access to encryption keys.

The company wants to separate the duties of the two teams to ensure that configuration errors by only one of these teams will not compromise the data by granting unauthorized access to plaintext data.

Which solution will meet this requirement?

A. Ensure that the operations team configures default bucket encryption on the S3 bucket to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to use the encryption keys.
B. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed. Ensure that the security team creates a key policy that controls access to the encryption keys.
C. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with Amazon S3 managed keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to the encryption keys.
D. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with customer-provided encryption keys (SSE-C). Ensure that the security team stores the customer-provided keys in AWS Key Management Service (AWS KMS). Ensure that the security team creates a key policy that controls access to the encryption keys.

Show Suggested Answer

Suggested Answer: B 🗳️

by woonsi at March 16, 2025, 3:47 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

woonsi

2 days, 7 hours ago

Selected Answer: B

🎯 Let’s break this down: The goal is to separate responsibilities between the operations team (who manages bucket access) and the security team (who manages encryption keys) to prevent a single team’s mistake from exposing plaintext data.

upvoted 1 times

woonsi

2 days, 7 hours ago

🔒 1. Use SSE-KMS with customer-managed keys • SSE-KMS (AWS Key Management Service) lets you encrypt data with keys that are separately controlled. • The operations team controls the bucket’s access policies, but they cannot decrypt the data without the key — which the security team controls. 👉 This creates a clear separation of duties: • Operations team: Sets a bucket policy requiring SSE-KMS encryption for all writes to the bucket. • Security team: Manages the KMS key policy to control who can use the key for decryption. Even if the operations team misconfigures the bucket, the security team’s key policy still prevents unauthorized decryption.

upvoted 1 times

...

Exam AWS Certified Security - Specialty SCS-C02 All Questions

View all questions & answers for the AWS Certified Security - Specialty SCS-C02 exam

Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 255 discussion

Comments

woonsi

woonsi

SY0-701