Examkin

Question

Difficulty: MediumData Protection and Encryption

A media streaming company is storing user account information in Amazon S3 and database backups in Amazon RDS. The company's compliance policy requires all of this data to be encrypted at rest. According to the AWS Shared Responsibility Model, which of the following is a customer responsibility in this scenario?

  1. A
    Ensuring the physical destruction of retired storage media that contained the backups
  2. B
    Managing the physical security of the hardware security modules that protect the keys
  3. Configuring server-side encryption and managing access policies for the cryptographic keysAnswer
  4. D
    Applying security patches to the physical hypervisors running the key management services

Answer

Configuring server-side encryption and managing access policies for the cryptographic keys
Under the AWS Shared Responsibility Model, the customer is responsible for data encryption configurations (security in the cloud), which includes enabling server-side encryption on services like Amazon S3 and Amazon RDS and specifying who has permissions to use the encryption keys.

Step-by-Step Solution

1
Identify that the requirement is for encrypting data at rest (stored in Amazon S3 and Amazon RDS).
Recognized that this falls under data protection and key management.
Encryption of data at rest involves both selecting the encryption mechanism and managing the access controls to the keys used for encryption.
2
Apply the AWS Shared Responsibility Model, dividing tasks into customer responsibility (security in the cloud) and AWS responsibility (security of the cloud).
Differentiated infrastructure management from resource configuration.
AWS manages physical data centers, hardware security, hypervisors, and storage sanitization, while customers configure resources, access permissions, and choose whether/how to enable encryption.
3
Select the option that represents a customer-managed action.
Identified that enabling server-side encryption and managing key access policies is the customer's duty.
Only configuring the encryption settings and controlling access policies is under the customer's direct control within the AWS Management Console or APIs.

Key Concept

Data protection at rest and the Shared Responsibility Model
Estimated Time:1m 0s
Rate this question

Topics

Data Protection and Encryption

More questions from this topic