Examtopics

AWS Certified Security - Specialty
  • Topic 1 Question 265

    A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3).

    A security engineer must prevent any modifications to the data in the S3 bucket.

    Which solution will meet this requirement?

    • Configure S3 bucket policies to deny DELETE and PUT object permissions.

    • Configure S3 Object Lock in compliance mode with S3 bucket versioning enabled.

    • Change the encryption on the S3 bucket to use AWS Key Management Service (AWS KMS) customer managed keys.

    • Configure the S3 bucket with multi-factor authentication (MFA) delete protection.


    シャッフルモード