All new S3 buckets that store resident personal data must default to strong encryption at rest and must not be publicly accessible. Which baseline best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Resident data buckets should arrive locked: KMS encryption on, public access blocked. Hoping someone remembers later is how a private filing cabinet becomes a sidewalk display.
Full Explanation
Buckets storing resident personal data must default to strong encryption at rest and must not be publicly accessible. Applying SSE-KMS with customer-managed or AWS-managed keys as policy requires, plus S3 Block Public Access on buckets and account baselines, establishes that secure default. ACLs granting Everyone WRITE with only client-side XOR obfuscation fail confidentiality and access control. Leaving default encryption off and hoping developers remember per-object settings creates avoidable gaps. Enabling public website hosting on every resident-data bucket for transparency contradicts privacy and least-exposure requirements. Exam caveat: encryption without key policy and IAM discipline can still allow broad decrypt; pair KMS grants with least privilege and Macie or access logging as needed. Operational check: create a baseline bucket, verify default SSE-KMS, confirm Block Public Access denies public ACLs and policies, and attempt a public GetObject that must fail. In municipal cloud governance, record the owners, success metrics, and rollback or restore contacts beside this technical choice so the next incident, budget review, or audit does not rediscover the decision from scratch under time pressure.