A county records archive in Amazon S3 must be encrypted at rest with customer managed KMS keys, and key usage must be auditable. Which design best satisfies those controls?
Select an answer to reveal the explanation.
Short Explanation
County records need a named key you control—SSE-KMS with a CMK—and CloudTrail is the guestbook showing who borrowed that key. Checksums and naked EBS volumes do not give you audited encryption at rest.
Full Explanation
Task 1.3 expects encryption at rest with KMS and auditable key use. SSE-KMS with a customer managed key encrypts S3 objects under keys the county controls, while CloudTrail records KMS API activity for investigations. Unencrypted storage or checksum-only approaches do not meet encryption and key-audit requirements.