CLF-C02 · Drill mode

Which two are valid ways to protect sensitive data stored in Amazon S3? (Choose TWO.)

• AA. Enable S3 server-side encryption (SSE-S3, SSE-KMS, or DSSE-KMS) on the bucket
• BB. Encrypt the data client-side before uploading and manage your own keys
• CC. Delete all the encryption keys after data is encrypted
• DD. Delete every IAM user that has access to S3
• EE. Disable bucket policies entirely