Security World 3 · Lock and Key · Stage 3

At Rest Everywhere

Encryption at rest is mostly a default you must not undo, and three rules the exam loves: the header, the shared snapshot, and the database you cannot encrypt later.

S3 default encryption
SSE-KMS and Bucket Keys
DSSE-KMS
Client-side encryption
EBS and RDS encryption
Snapshot sharing

Domain: Security
World: Security World 3: Lock and Key (Professional)
Game type: Policy stepper: Edit identity, resource and key policies; the matrix shows the gate that decided.
Time: About 30 minutes on a first attempt (estimated)
Exam guides: SAA-C03Task 1.3: Determine appropriate data security controls
SOA-C03Skill 4.2.2: Implement, configure, and troubleshoot encryption at rest (for example, AWS KMS)
DEA-C01Skill 4.3.2: Use encryption keys to encrypt or decrypt data (for example, AWS KMS)
SCS-C03Skill 5.2.1: Design, implement, and configure data encryption at rest based on specific requirements (for example, by selecting the appropriate encryption key service such as AWS CloudHSM or AWS KMS or by selecting the appropriate encryption type such as client-side encryption or server-side encryption); Skill 5.2.4: Design and configure secure data replication and backup solutions (for example, Amazon Data Lifecycle Manager, AWS Backup, ransomware protection, AWS DataSync)