Task 1.3: Determine appropriate data security controls.

• AServer-side encryption with Amazon S3 managed keys (SSE-S3)

  Incorrect

  With SSE-S3, Amazon S3 manages the keys. There is no key policy for the company to write and no key to disable.

• BServer-side encryption with the AWS managed key aws/s3 (SSE-KMS)

  Incorrect

  Use of an AWS managed key appears in CloudTrail, but you cannot change its key policy or any of its properties, so you cannot disable it.

• CServer-side encryption with customer-provided keys (SSE-C)

  Incorrect

  With SSE-C the company manages its keys outside AWS and sends them with each request. There is no KMS key policy, and the key's use is not tracked in AWS KMS.

• DServer-side encryption with a customer managed KMS key (SSE-KMS)

  Correct

  A customer managed key is created and controlled by the company: it writes the key policy, can enable or disable the key, and every use is logged in CloudTrail.

Own key policy, audit trail and the power to disable: only a customer managed KMS key gives all three. AWS managed keys are auditable but not controllable.

• AAmazon GuardDuty with S3 protection turned on

  Incorrect

  GuardDuty is a threat detection service that analyzes activity in logs. It does not classify what the stored objects contain.

• BAmazon Macie with automated data discovery

  Correct

  Macie discovers sensitive data in S3 with machine learning and pattern matching, and automates discovery and reporting across buckets.

• CAmazon Inspector with continuous scanning on

  Incorrect

  Inspector scans EC2 instances, container images and Lambda functions for software vulnerabilities and network exposure, not S3 data.

• DAWS Config with managed rules for S3 buckets

  Incorrect

  Config evaluates how resources are configured, for example whether a bucket is public. It does not look inside objects for personal data.

Finding sensitive data inside S3 objects is Macie's job. GuardDuty watches activity, Inspector watches software, and Config watches configuration.

• AKeep importing the third-party certificate into ACM, and let ACM renew it automatically before it expires

  Incorrect

  ACM does not provide managed renewal for imported certificates. You must get a new certificate from the issuer and import it again.

• BUpload the third-party certificate to IAM as a server certificate and attach it to the HTTPS listener

  Incorrect

  IAM can store server certificates, but you upload and replace them yourself. AWS names ACM as the preferred tool, and only ACM certificates renew automatically.

• CRequest a public ACM certificate with DNS validation and use it on the load balancer's HTTPS listener

  Correct

  ACM provides managed renewal for the certificates it issues; with DNS validation and the certificate in use by the load balancer, renewal is automatic.

• DKeep the certificate's private key in an AWS CloudHSM cluster and point the HTTPS listener at the cluster

  Incorrect

  CloudHSM provides hardware security modules for keys you manage. It does not issue or renew certificates.

Automatic renewal belongs to certificates that ACM issues. Imported certificates and IAM server certificates stay a manual job.

• AUse AWS Backup with a plan that keeps recovery points for 7 years in a backup vault locked in compliance mode

  Correct

  Once the grace time ends, a compliance-mode vault lock cannot be changed or deleted by anyone, including the root user, while it holds recovery points.

• BTurn on RDS automated backups with the longest retention period, and take daily EBS snapshots with a lifecycle policy

  Incorrect

  RDS automated backups can be kept for at most 35 days, and nothing stops a privileged user from deleting snapshots.

• CUse AWS Backup with a plan that keeps recovery points for 7 years in a backup vault locked in governance mode

  Incorrect

  A vault locked in governance mode can have its lock removed by users with sufficient IAM permissions, so it does not stop everyone.

• DExport the backups to an S3 bucket with S3 Versioning on and a lifecycle rule that expires the objects after 7 years

  Incorrect

  Versioning keeps earlier versions, but a user with permission can still delete them. Write-once protection in S3 needs Object Lock.

"Nobody, including root" is the wording of compliance mode. Governance mode can be lifted by privileged users, and plain retention settings can be shortened.

• ATurn on automatic key rotation for the customer managed key in account A

  Incorrect

  Rotation replaces the key material. It does not change who is allowed to use the key.

• BAdd a key policy statement in account A that lets account B use the key to decrypt

  Correct

  Cross-account use of a KMS key needs the key policy in the owning account to allow the external account.

• CRe-encrypt the objects with the AWS managed key aws/s3 so that account B can use it

  Incorrect

  You cannot change the key policy of an AWS managed key, so you cannot grant another account access to it.

• DAttach an IAM policy to the role in account B that allows kms:Decrypt on the key's ARN

  Correct

  The external account must also delegate the permission to its own role through an IAM policy.

• EAttach an SCP to account B that allows kms:Decrypt on every key that account A owns

  Incorrect

  An SCP never grants permissions; it only limits what identity policies in the account can allow.

Cross-account KMS access takes two policies: the key policy in the key's account and an IAM policy in the caller's account. AWS managed keys cannot be shared this way.

• AS3 Object Lock in compliance mode with a 5-year default retention period

  Correct

  In compliance mode, no user, including the root user, can overwrite or delete a protected object version until its retention period ends.

• BS3 Versioning with a bucket policy that denies s3:DeleteObject to everyone

  Incorrect

  A privileged user can change or remove the bucket policy and then delete versions.

• CS3 Object Lock in governance mode with a 5-year default retention period

  Incorrect

  In governance mode, users with special permissions can override or remove the retention settings.

• DS3 Versioning with an S3 Lifecycle rule that keeps noncurrent versions 5 years

  Incorrect

  Lifecycle rules control when versions expire; they do not stop a user from deleting them earlier.

WORM that nobody can bypass is Object Lock compliance mode; governance mode can be overridden by privileged users.

• AModify the DB instance and turn on encryption at rest in the next maintenance window

  Incorrect

  RDS can encrypt a DB instance only when it is created, not by modifying an existing one.

• BCreate an encrypted read replica of the instance and then promote that replica

  Incorrect

  RDS does not allow an encrypted read replica of an unencrypted DB instance.

• CRestore the latest automated backup of the instance into a new encrypted instance

  Incorrect

  An unencrypted backup or snapshot cannot be restored to an encrypted DB instance directly.

• DSnapshot the instance, make an encrypted copy, and restore a new instance from it

  Correct

  Encryption can only be set when an instance is created, but an encrypted copy of a snapshot can be restored into an encrypted instance.

Snapshot, encrypted copy, restore: that is the documented path to encrypt an existing unencrypted RDS instance.

• AAdd a bucket policy that denies requests when aws:SecureTransport is false

  Correct

  AWS recommends allowing only HTTPS connections with the aws:SecureTransport condition in bucket policies.

• BTurn on default encryption with SSE-KMS for every object in the bucket

  Incorrect

  SSE-KMS protects data at rest. It does not control whether requests use an encrypted connection.

• CTurn on S3 Block Public Access for the bucket and for the whole account

  Incorrect

  Block Public Access stops public access grants; it does not reject unencrypted connections from allowed callers.

• DIssue an ACM certificate for the bucket and attach it to the bucket's S3 endpoint

  Incorrect

  ACM certificates are deployed to integrated services such as load balancers and CloudFront, not attached to an S3 bucket endpoint.

Encryption in transit for S3 is enforced in the bucket policy with aws:SecureTransport.

• ACreate a new KMS key every year and re-encrypt all data under the new key

  Incorrect

  It works, but re-encrypting all data every year is a large recurring job that rotation makes unnecessary.

• BTurn on automatic key rotation for the existing customer managed key

  Correct

  Automatic rotation generates new key material on a schedule (yearly by default) and keeps the old material to decrypt existing data.

• CSwitch the data to the AWS managed key and rotate that key manually each year

  Incorrect

  You cannot rotate or change the properties of AWS managed keys.

• DChange the key policy each year so that a new set of roles can use the key

  Incorrect

  Changing who may use a key does not change its key material.

KMS rotation swaps the current key material but keeps the older material to decrypt what it encrypted, so nothing has to be re-encrypted.

• ASchedule a daily on-demand backup and keep the backups for 30 days

  Incorrect

  Daily backups can restore only to the moment each backup was taken, so up to a day of changes could be lost.

• BTurn the table into a global table with a replica in a second Region

  Incorrect

  Replicas copy every write, including the bad ones, so they do not provide an earlier state to restore.

• CTurn on point-in-time recovery with a 30-day or longer recovery period

  Correct

  PITR keeps continuous backups with per-second recovery points for up to 35 days, with nothing to schedule.

• DAdd a TTL attribute so that overwritten items are removed after 30 days

  Incorrect

  TTL deletes expired items; it does not keep earlier versions of items to restore.

Per-second recovery without scheduled jobs is DynamoDB point-in-time recovery.