A municipal brine-yard route helper sends tonight’s addresses from a yard laptop to Amazon Bedrock. Which pair of controls is required?
Select an answer to reveal the explanation.
Short Explanation
Think of tonight’s addresses leaving a yard laptop toward Bedrock. Encrypt in transit with TLS and at rest with a bucket or key policy. Hoping the yard Wi-Fi is fine is not a pair of controls.
Full Explanation
Tonight’s brine-yard addresses leaving a yard laptop toward Amazon Bedrock must be protected with encryption in transit and encryption at rest. TLS covers the hop from the client to the service; bucket encryption or a managed key policy covers stored prompts, completions, and any staging objects. That pair is the baseline secure-data-engineering control for municipal routing content that includes location and operational detail.
Assuming yard Wi-Fi is probably fine and skipping TLS and at-rest keys fails by concept: local network trust is not a substitute for cryptographic protection end to end, and residual risk on shared or guest Wi-Fi remains. Amazon Polly fails because speech synthesis does not encrypt addresses in motion or at rest; it is an unrelated modality service. Raising temperature fails because sampling randomness never establishes a TLS session or a key policy; generation parameters are not cryptographic controls.
Exam caveat: encryption does not by itself enforce who may call Bedrock or which yard laptop is authorized—pair it with identity, least privilege, and network controls. Operational check: confirm the client rejects non-TLS endpoints, inspect the destination bucket or log store for default encryption with a customer-managed or account key policy, and verify a test address never lands in cleartext on disk or in transit captures.