A healthcare organization is building a data lake on Amazon S3 to store patient records. They must comply with HIPAA regulations. The data must be encrypted at rest using keys that the organization exclusively controls and rotates. Access to the data must be strictly limited to a specific IAM role, and any access from outside the corporate VPC must be blocked. Which combination of configurations will meet these requirements? (Select THREE)

Answer options:

Encrypt the S3 bucket using Amazon S3 Managed Keys (SSE-S3).

Encrypt the S3 bucket using AWS KMS Customer Managed Keys (CMKs).

Attach a bucket policy that denies access if the aws:SourceVpce condition is not met.

Use a VPC Endpoint for S3 in the corporate VPC.

Configure S3 Object Lock in Governance mode.

Use AWS Shield Advanced to protect the bucket from unauthorized access.

How to approach this question

Identify CMKs for key control, and VPC Endpoints + Bucket Policies for network isolation.

Full Answer

Encrypt the S3 bucket using AWS KMS Customer Managed Keys (CMKs). Attach a bucket policy that denies access if the aws:SourceVpce condition is not met. Use a VPC Endpoint for S3 in the corporate VPC.

To exclusively control encryption keys, AWS KMS Customer Managed Keys (CMKs) must be used. To restrict access to a specific VPC, you must deploy a VPC Endpoint for S3 and use an S3 bucket policy with the aws:SourceVpce condition to deny all traffic not originating from that endpoint.

Common mistakes

Choosing SSE-S3, which doesn't provide customer control over the keys.

Question 51 All questions Question 53

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 4

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is redesigning its network architecture across 50 AWS accounts. They require ...Hard Q02A financial services company uses AWS Organizations to manage 100+ accounts. The security team ma...Medium Q03An e-commerce company requires a multi-region active-active architecture for its critical order p...Medium Q04A company is setting up a new AWS environment using AWS Control Tower. They need to ensure that a...Hard Q05An enterprise has 50 AWS accounts under AWS Organizations. They want to implement a chargeback mo...Medium

View all 75 questions →