A Developer is storing sensitive data generated by an application in Amazon S3. The Developer wants to encrypt the data at rest. A company policy requires an audit trail of when the master key was used and by whom. Which encryption option will meet these requirements?
A) Server-side encryption with Amazon S3 managed keys (SSE-S3)
B) Server-side encryption with AWS KMS managed keys (SSE-KMS)
C) Server-side encryption with customer-provided keys (SSE-C)
D) Server-side encryption with self-managed keys

Question

Quizplus · Accepted Answer

AWS KMS managed keys (SSE-KMS) provide an audit trail in AWS CloudTrail, showing when the master key was used and by whom, meeting the company's requirement for an audit trail.

A Developer Is Storing Sensitive Data Generated by an Application