What's changed: In-scope coverage (fix): added AWS WAF (L7 web protection; SQLi/XSS/rate-limit via IaC) to the Network Firewall block (closes an Axis-B textbook gap)
6.3Data Protection and Auditing
Understand data protection and trails—KMS (encryption), encryption at rest/in transit, CloudTrail (API auditing), S3 Object Lock/versioning, and tamper-proof trails. Meet compliance requirements.
Compliance requires encryption and audit trails. Encrypt with KMS, record actions with CloudTrail, and prevent tampering.
6.3.1Encryption and auditing
- KMS: at-rest encryption (envelope encryption, key rotation) for S3/EBS/RDS, etc.
- In-transit encryption: protect traffic with TLS.
- CloudTrail: audit API actions; aggregate all accounts with an organization trail.
- Object Lock/versioning: protect logs/trails from tampering/deletion with WORM.
Common on DOP-C02: at-rest encryption/key management = KMS (envelope, rotation), API auditing = CloudTrail (organization trail), tamper-proof trails = S3 Object Lock (WORM) + versioning, continuous compliance like mandatory encryption = Config. Protecting the CloudTrail logs themselves (dedicated account + WORM) is commonly tested.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.