All new S3 buckets that store resident personal data must default to strong encryption at rest and must not be publicly accessible. Which baseline best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Resident data buckets should arrive locked: KMS encryption on, public access blocked. Hoping someone remembers later is how a private filing cabinet becomes a sidewalk display.
Full Explanation
Encryption at rest with SSE-KMS and S3 Block Public Access are standard defaults for sensitive resident data. Public ACLs, optional-per-upload encryption without defaults, and public website hosting on personal-data buckets conflict with confidentiality requirements.