CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Solutions Architect - Associate: Secure Data Sharing Exam Question Walkthrough
Explore a key AWS exam question about secure data sharing. Understand why the right choice is crucial and how to avoid common traps.
Sharing sensitive data securely can trip up candidates during the AWS Certified Solutions Architect - Associate exam. Many options seem viable, but only one ensures proper encryption and access control.
The question
A company needs to securely share sensitive data with a partner organization using AWS. They want to ensure that only the partner can access the data and that it remains encrypted during transit. What is the best approach to achieve this?
- A. Use Amazon S3 and set a public bucket policy.
- B. Use AWS Transfer Family with SFTP and encrypt data using KMS.
- C. Use AWS DataSync with encryption enabled and public sharing.
- D. Use Amazon RDS with IAM authentication and enable public accessibility.
Think before you scroll
Before you choose an answer, consider the requirements: secure sharing, encryption during transit, and access control. Some options may seem secure at first glance but fail to meet all criteria.
The answer
The correct option is B. Use AWS Transfer Family with SFTP and encrypt data using KMS. This approach allows for secure data transfer using SFTP, and encrypting data with AWS Key Management Service (KMS) ensures that it remains confidential during transit.
Why the other options lose
- A. Use Amazon S3 and set a public bucket policy. This option is insecure. A public bucket policy would allow anyone on the internet to access the data, violating the requirement that only the partner organization can access it.
- C. Use AWS DataSync with encryption enabled and public sharing. While DataSync can encrypt data, enabling public sharing contradicts the need for secure access. Public sharing opens the data to anyone, which is not acceptable for sensitive information.
- D. Use Amazon RDS with IAM authentication and enable public accessibility. Even though IAM authentication adds a layer of security, enabling public accessibility exposes the database to the internet. This does not meet the requirement for secure data sharing.
The concept behind it
The principle here is understanding secure data transfer methods. AWS Transfer Family with SFTP provides a secure, encrypted channel for transferring files, while KMS ensures that data remains encrypted during transit. Always evaluate options based on access control and encryption requirements, especially when dealing with sensitive data.
Exam trap to remember
Always avoid public accessibility settings for sensitive data sharing. Secure transfer methods must ensure that only authorized parties have access.