HikeHills.com (HH) is an online specialty retailer that sells clothing and outdoor refreshment gear for trekking, go camping, boulevard biking, mountain biking, rock hiking, ice mountaineering, skiing, avalanche protection, snowboarding, fly fishing, kayaking, rafting, road and trace running, and many more.
HHruns their entire online infrastructure on java based web applications running on AWS. The HH is capturing click stream data and use custom-build recommendation engine to recommend products which eventually improve sales, understand customer preferences and already using AWS Kinesis Streams API and Agents to collect events and transaction logs and process the stream. The event/log size is around 12 Bytes.
The data transformation and conversion is applied using kinesis firehose and stored in S3. Since the data captured is sensitive, HH is looking to enable encryption end to end for all the data sources. The data processed through kinesis firehose is captured from Kinesis Stream and other data sources though kinesis agent, firehose API, etc. How can this be enabled? select 2 options.

Answer options:

A.Server-Side Encryption with Kinesis Data Streams as the Data Source
B.Client-Side Encryption with Kinesis Data Streams as the Data Source
C.Client-Side Encryption with Direct PUT or Other Data Sources
D.Server-Side Encryption with Direct PUT or Other Data Sources

Answer: A,D
Enable server-side data encryption when you use Amazon Kinesis Data Firehose. The data encryption can be enabled through two modes.
Server-Side Encryption with Kinesis Data Streams as the Data Source using AWS Key Management Service (AWS KMS) key before storing the data at rest
Server-Side Encryption with Direct PUT or Other Data Sources using StartDeliveryStreamEncryption operation. 
https://docs.aws.amazon.com/firehose/latest/dev/encryption.html