Your company hosts critical data in an S3 bucket. There is a requirement to ensure that all data is encrypted. The metadata about the information stored in the bucket needs to be encrypted as well. Which of the below measures would you take to ensure that the metadata is encrypted?

Answer options:

A.Put the metadata as metadata for each object in the S3 bucket and then enable S3 Server-side encryption.
B.Put the metadata as metadata for each object in the S3 bucket and then enable S3 Server KMS encryption.
C.Put the metadata in a DynamoDB table and ensure the table is encrypted during creation time.
D.Put the metadata in the S3 bucket itself.

Answer: C
Options A, B and D are incorrect because when the S3 bucket objects are encrypted, the metadata is not encrypted.
Option C is CORRECT because when the S3 bucket objects are encrypted, the metadata is not encrypted. So the best option is to store the metadata in the DynamoDB table and encrypt using AWS KMS during the table creation process.
For more information on using KMS encryption for S3, please refer to the below URL:
https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html