Question

A financial services company is moving its it infrastructure to aws cloud and wants to enforce adequate data protection mechanisms on amazon simple storage service (amazon s3) to meet compliance guidelines. the engineering team has hired you as a solutions architect to build a solution for this requirement. can you help the team identify the incorrect option from the choices below?

a. S3 can protect data at rest using Server-Side Encryption
b. S3 can encrypt data in transit using HTTPS (TLS)
c. S3 can encrypt object metadata by using Server-Side Encryption
d. S3 can protect data at rest using Client-Side Encryption

Answer 1

The incorrect option is that 'S3 can encrypt object metadata by using Server-Side Encryption' because while S3 encrypts the object data and its metadata tags, it does not specifically encrypt the metadata itself.

Step-by-step explanation:

The regarding identifying the incorrect option related to data protection mechanisms in Amazon Simple Storage Service (Amazon S3), as part of an AWS cloud infrastructure for a financial services company. Let's review the options presented:

• S3 can protect data at rest using Server-Side Encryption: This is correct. Amazon S3 supports server-side encryption (SSE) for encrypting the stored data.
• S3 can encrypt data in transit using HTTPS (TLS): This is also correct. S3 supports data encryption in transit using HTTPS, which applies the TLS protocol to encrypt the data as it moves between the client and the server.
• S3 can encrypt object metadata by using Server-Side Encryption: This is the incorrect option. While Amazon S3 encrypts the object's data and its associated metadata tags when you use server-side encryption, it does not specifically encrypt the metadata itself. Instead, only the object data is encrypted.
• S3 can protect data at rest using Client-Side Encryption: This is correct. With client-side encryption, the data is encrypted by the client before it is transferred to S3.

In conclusion, the incorrect option is the one stating that 'S3 can encrypt object metadata by using Server-Side Encryption' because it gives the impression that S3 provides a separate encryption mechanism for the object metadata, which it does not.