AWS Certified Solutions Architect Professional · Free Practice Question Medium
Question 14
An Amazon Redshift cluster is used to store sensitive information of a business-critical application. The compliance guidelines mandate tracking audit logs of the Redshift cluster. The business needs to store the audit logs securely by encrypting the logs at rest. The logs are to be stored for a year at least and audits need to be conducted on the audit logs every month.
Which of the following is a cost-effective solution that fulfills the requirement of storing the logs securely while having access to the logs for monthly audits?
-
A
Enable default encryption on the Amazon S3 bucket that uses Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Use Amazon Redshift Spectrum to query the data for monthly audits
-
B
Enable encryption on the Amazon S3 bucket that uses Amazon Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS) for audit logging. Use Amazon Redshift Spectrum to query the data for monthly audits
-
C
Enable default encryption on the Amazon S3 bucket that uses Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Copy the data into the Amazon Redshift cluster from Amazon S3 when data needs to be queried for monthly audits
-
D
Enable encryption on the Amazon S3 bucket that uses Amazon Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS) for audit logging. Use Amazon QuickSight to query the data for monthly audits
Reveal correct answer
Correct answer: A
Explanation
Correct option:
Enable default encryption on the Amazon S3 bucket that uses Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Use Amazon Redshift Spectrum to query the data for monthly audits
Audit logging is not turned on by default in Amazon Redshift. When you turn on logging on your cluster, Amazon Redshift creates and uploads logs to Amazon S3 that capture data from the time audit logging is enabled to the present time. Each logging update is a continuation of the information that was already logged.
Audit logging to Amazon S3 is an optional, manual process. When you enable logging on your cluster, you are enabling logging to Amazon S3 only. Currently, you can only use Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging.
Amazon Redshift Spectrum is a feature of Amazon Redshift that lets you run queries against your data lake in Amazon S3, with no data loading or ETL required. When you issue an SQL query, it goes to the Amazon Redshift endpoint, which generates and optimizes a query plan. Amazon Redshift determines what data is local and what is in Amazon S3, generates a plan to minimize the amount of S3 data that needs to be read, and requests Amazon Redshift Spectrum workers out of a shared resource pool to read and process data from S3.
Incorrect options:
Enable default encryption on the Amazon S3 bucket that uses Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Copy the data into the Amazon Redshift cluster from Amazon S3 when data needs to be queried for monthly audits - Copying data into the Redshift cluster for enabling monthly audits would turn out to be a costly solution. Using Redshift Spectrum is the right fit for the given scenario.
Enable encryption on the Amazon S3 bucket that uses Amazon Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS) for audit logging. Use Amazon QuickSight to query the data for monthly audits
Enable encryption on the Amazon S3 bucket that uses Amazon Server-Side Encryption with KMS keys Stored in AWS Key Management Service (SSE-KMS) for audit logging. Use Amazon Redshift Spectrum to query the data for monthly audits
Currently, you can only use Amazon S3-managed keys (SSE-S3) encryption (AES-256) for audit logging. Hence, both these options are incorrect.
References:
https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html
https://docs.aws.amazon.com/redshift/latest/dg/c-using-spectrum.html
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
