A data lake must encrypt everything at rest — S3 objects, Glue metadata, EMR temp data, and Athena results — with auditable key control. What's the standard approach?
A.SSE-S3 on the bucket only
Covers only S3 objects — misses catalog and results.
B.SSE-KMS for S3 + Glue Data Catalog encryption + KMS-encrypted Athena results — one auditable key layer
Correct. One KMS layer across all lake components.
C.Client-side encryption for everything
Maximum operational burden — KMS already handles it.
D.TLS on all connections
TLS is in-transit, not at-rest.
Why this answer
KMS-based encryption covers the whole lake stack — S3 objects, the Glue catalog (metadata-at-rest encryption), EMR local disks, Athena query results — with CloudTrail key-usage auditing. SSE-S3 works for objects but offers no key control/audit and doesn't cover catalog/results.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Governance practice session.
Practice Data Governance