AWS Certified Data Engineer Associate · Free Practice Question Medium
Question 26
A legal firm wishes to store highly confidential case files in Amazon S3, with a requirement that only designated lawyers can view and edit the files. The firm also needs the ability to track which specific users accessed or modified a file.
What measure should the firm implement to control and audit file access?
-
A
Apply an S3 bucket policy that restricts access to the files based on IAM user roles and enable S3 access logging for audit trails.
-
B
Enable S3 Versioning and MFA Delete on the bucket, requiring multi-factor authentication for file access.
-
C
Encrypt files using S3 server-side encryption with AWS KMS-managed keys (SSE-KMS) and restrict key usage permissions to designated lawyers.
-
D
Use S3 Object Lock with governance mode to prevent files from being deleted or overwritten and apply IAM policies for access control.
Reveal correct answer
Correct answer: C
Explanation
By encrypting files with SSE-KMS, the firm can specify which AWS KMS key is used for encryption and then use the key policy to precisely control which users have permissions to use the key to encrypt and decrypt files. AWS KMS also provides an audit capability by logging key usage to AWS CloudTrail, enabling the firm to see which user accessed or modified a file.
CORRECT: "Encrypt files using S3 server-side encryption with AWS KMS-managed keys (SSE-KMS) and restrict key usage permissions to designated lawyers" is the correct answer (as explained above.)
INCORRECT: "Apply an S3 bucket policy that restricts access to the files based on IAM user roles and enable S3 access logging for audit trails" is incorrect.
While S3 bucket policies and S3 access logging can restrict access and provide audit logs, they do not offer the granular encryption key management or the tracking of individual key usage that AWS KMS does
INCORRECT: "Enable S3 Versioning and MFA Delete on the bucket, requiring multi-factor authentication for file access" is incorrect.
S3 Versioning and MFA Delete provide additional security against accidental deletions and overwrites, but they do not control file access permissions at the user level or log specific user access.
INCORRECT: "Use S3 Object Lock with governance mode to prevent files from being deleted or overwritten and apply IAM policies for access control" is incorrect.
S3 Object Lock prevents objects from being deleted or overwritten for a fixed amount of time or indefinitely, but it is primarily used for compliance retention requirements and does not manage user-level access or encryption key usage.
References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingEncryption.html
Save time with our AWS cheat sheets:
https://digitalcloud.training/aws-certified-data-engineer-associate-cheat-sheet/
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
