S3 Security

Question 1

Encrypts S3 objects using keys handled, managed, and owned by AWS

Answer 1

Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)

Question 2

Leverage AWS Key Management Service (AWS KMS) to manage encryption keys

Answer 2

Server-Side Encryption with KMS Keys stored in AWS KMS (SSE-KMS)

Question 3

When you want to manage your own encryption keys using keys fully managed by the customer outside of AWS

Answer 3

Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 4

Does Amazon store the encryption key when using SSE-C?

Answer 4

No

Question 5

Clients must encrypt data themselves before sending to Amazon S3 and when retrieving from Amazon S3. Customer fully manages the keys and encryption cycle

Answer 5

Client-Side Encryption

Question 6

Encryption in flight is also called

Answer 6

SSL/TLS

Question 7

S3 non encrypted endpoints

Answer 7

HTTP Endpoint

Question 8

S3 encryption in flight

Answer 8

HTTPS Endpoint

Question 9

S3 encryption automatically applied to new objects stored in S3 bucket

Answer 9

SSE-S3

Question 10

Defines a way for client web applications that are loaded in one domain to interact with resources in a different domain

Answer 10

Cross-Origin Resource Sharing (CORS)

Question 11

Create a Vault Lock Policy which locks the policy for future edits

Answer 11

Glacier Vault Lock

Question 12

Block an object version deletion for a specified amount of time

Answer 12

S3 Object Lock

Question 13

Retention mode where object versions can’t be overwritten or deleted by any user, including the root user

Answer 13

Retention mode - Compliance

Question 14

Retention mode where most users can’t overwrite or delete an object version or alter its lock settings.some users have permission to change the retention or delete the object

Answer 14

Retention mode - Governance

Question 15

Protect the object indefinitely, independent from retention period

Answer 15

Legal Hold

Question 16

Use AWS Lambda Functions to change the object before it is retrieved by the caller application

Answer 16

S3 Object Lambda