What's changed: Deepened SCS-C02 Chapter 5 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
5.3Protecting Storage and Database Data
Understand protecting stores—S3 encryption (SSE-S3/SSE-KMS/DSSE), S3 public-access block/bucket policies, EBS/RDS encryption, backup protection, and data lifecycle. Store data securely.
Protect data stores with encryption and access control. S3 public-access prevention and encryption choices are especially common.
5.3.1Store protection
- S3 encryption: choose from SSE-S3 (AWS-managed)/SSE-KMS (CMK, auditable)/DSSE (double).
- S3 public-access prevention: prevent accidental exposure with Block Public Access + restrictive bucket policy.
- EBS/RDS encryption: KMS at-rest encryption (snapshots encrypted too).
- Backup protection: prevent tampering/deletion with a separate account/region + WORM.
Common on SCS-C02: audit/control S3 keys = SSE-KMS, prevent accidental exposure = Block Public Access + bucket policy, EBS/RDS at-rest = KMS (incl. snapshots), backups in a separate account + WORM. Prevent S3 exposure by enabling Block Public Access at the account level.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.