A county policy requires highly sensitive case files to be encrypted on the client before any upload to Amazon S3, so plaintext never reaches S3 unencrypted even prior to server-side encryption. Which approach correctly distinguishes that requirement?
Select an answer to reveal the explanation.
Short Explanation
Client-side encryption is locking the briefcase before it enters the courthouse mailroom—S3 only ever sees ciphertext. SSE is the mailroom’s own vault; sometimes policy still wants the briefcase locked first.
Full Explanation
Client-side encryption encrypts data before it leaves the client, which differs from server-side encryption where S3 encrypts after receiving the object. When policy requires that plaintext never be sent to S3, client-side encryption is the appropriate control, optionally in addition to SSE. Tags or versioning alone do not encrypt.