A company must apply two layers of server-side encryption to objects uploaded to an S3 bucket and wants to use a Lambda function to apply the encryption. Which approach meets this requirement?
Choose an answer
Tap an option to check your answer.
Correct answer: Use dual-layer server-side encryption with AWS KMS keys (DSSE-KMS)..
Why this is the answer
DSSE-KMS is the correct choice because it provides two distinct layers of server-side encryption using AWS KMS keys, directly fulfilling the requirement for two layers of server-side encryption. This is a built-in S3 encryption option designed for enhanced security. Using both SSE-KMS and the Amazon S3 Encryption Client would involve client-side encryption in addition to server-side, which is not what the question explicitly asks for (it specifies server-side encryption for both layers). SSE-C involves customer-provided keys and is a single layer of encryption, not two, and is applied before upload, not by a Lambda function applying encryption to objects uploaded. SSE-KMS alone provides only one layer of server-side encryption, failing to meet the two-layer requirement.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed