Your company hosts critical data in an S3 bucket. There is a requirement to ensure that all data is encrypted. The metadata about the information stored in the bucket needs to be encrypted as well. Which of the below measures would you take to ensure that the metadata is encrypted?

Answer options:

A.Put the metadata for each object in the S3 bucket and enable S3 server-side encryption with SSE-S3.
B.Put the metadata for each object in the S3 bucket and enable S3 server-side encryption with SSE-KMS.
C.Put the metadata in a DynamoDB table and ensure the table is encrypted during creation.
D.Put the metadata in the S3 bucket itself.

Answer is C
Options A and B are incorrect because when the S3 bucket objects are encrypted, the metadata is not encrypted. Hence the server-side encryption would not fulfill the ask.
Option C is correct as with an encrypted DynamoDB table, the metadata is encrypted. It can meet the required expectations.
Option D is incorrect because when the S3 bucket has enabled the encryption, the metadata is still not encrypted.
For more information on server-side encryption for Amazon S3, please refer the URL below:
https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html