A healthcare organization is building a data lake on Amazon S3 to store patient records. They must comply with HIPAA regulations. The data must be encrypted at rest using keys that the organization exclusively controls and rotates. Access to the data must be strictly limited to a specific IAM role, and any access from outside the corporate VPC must be blocked. Which combination of configurations will meet these requirements? (Select THREE)

Identify CMKs for key control, and VPC Endpoints + Bucket Policies for network isolation.

What mistakes do candidates make on this AWS SAP-C02 question?

Choosing SSE-S3, which doesn't provide customer control over the keys.

Q01A global enterprise is redesigning its network architecture across 50 AWS accounts. They require ...Hard

Q02A financial services company uses AWS Organizations to manage 100+ accounts. The security team ma...Medium

Q03An e-commerce company requires a multi-region active-active architecture for its critical order p...Medium

Q04A company is setting up a new AWS environment using AWS Control Tower. They need to ensure that a...Hard

Q05An enterprise has 50 AWS accounts under AWS Organizations. They want to implement a chargeback mo...Medium