A Security Administrator is configuring an Amazon S3 bucket and must meet the following security requirements:✑ Encryption in transit✑ Encryption at rest✑ Logging of all object retrievals in AWS CloudTrailWhich of the following meet these security requirements?
(Choose three.)
Specify ג€aws:SecureTransportג€: ג€trueג€ within a condition in the S3 bucket policy.
Enable a security group for the S3 bucket that allows port 443, but not port 80.
Set up default encryption for the S3 bucket.
Enable Amazon CloudWatch Logs for the AWS account.
Enable API logging of data events for all S3 objects.
Enable S3 object versioning for the S3 bucket.
Explanations:
Specifying “aws”: “true” in the bucket policy ensures that all requests use HTTPS, fulfilling encryption in transit.
Security groups are used for EC2 instances, not for S3 buckets. S3 bucket security is managed via policies and settings, not security groups.
Enabling default encryption for the S3 bucket ensures encryption at rest, meeting one of the security requirements.
Amazon CloudWatch Logs are used for monitoring and operational logging, not for logging S3 object retrievals. CloudTrail is needed for this purpose.
Enabling API logging of data events in AWS CloudTrail ensures that all object retrievals are logged, fulfilling the requirement for logging.
Enabling S3 object versioning does not meet the encryption or logging requirements. It simply retains previous versions of objects.
I outline that the answer is:
Specify ג€aws:SecureTransportג€: ג€trueג€ within a condition in the S3 bucket policy.
In my experience, the answer is:
Specify ג€aws:SecureTransportג€: ג€trueג€ within a condition in the S3 bucket policy.