Examkin

Question

Difficulty: MediumData Protection and Encryption

A medical device manufacturer is deploying an application on AWS that handles sensitive patient health data. The company's compliance framework requires that all data at rest be encrypted using keys stored on dedicated, single-tenant hardware security modules that the customer directly manages. Additionally, the company must maintain responsibility for configuring access to these keys.

Which of the following actions are responsibilities of the customer to meet these requirements? (Select TWO.)

  1. Provisioning dedicated hardware security modules using AWS CloudHSMAnswer
  2. Configuring key policies and user permissions to control access to the cryptographic keysAnswer
  3. C
    Using AWS Key Management Service (KMS) with default AWS-managed keys to store the encryption keys
  4. D
    Managing the physical security of the data center facilities housing the hardware security modules
  5. E
    Replacing and maintaining the physical components of the hardware security modules in the event of hardware failure

Answer

Provisioning dedicated hardware security modules using AWS CloudHSM and configuring key policies and user permissions to control access to the cryptographic keys
The correct actions are provisioning dedicated hardware security modules using AWS CloudHSM and configuring key policies and user permissions. AWS CloudHSM satisfies the compliance requirement for dedicated, single-tenant hardware. Managing permissions and policies to secure access to these keys is a customer responsibility under the AWS Shared Responsibility Model.

Step-by-Step Solution

1
Identify the cryptographic hardware requirement (dedicated, single-tenant hardware security modules directly managed by the customer).
Determine that this maps to AWS CloudHSM rather than AWS Key Management Service (KMS).
AWS CloudHSM is the only AWS service offering dedicated, single-tenant HSMs under direct customer control.
2
Evaluate the customer's administrative boundaries for cryptographic keys under the Shared Responsibility Model.
Identify that configuring access policies and permissions is the customer's duty.
The customer is responsible for security 'in' the cloud, which includes configuring key policies and permissions.
3
Differentiate between customer responsibilities and AWS physical infrastructure duties.
Eliminate options involving physical security and hardware replacement.
AWS is responsible for security 'of' the cloud, meaning physical maintenance and facility security are handled exclusively by AWS.

Key Concept

Distinction between AWS KMS and AWS CloudHSM, and the mapping of data protection responsibilities under the AWS Shared Responsibility Model.
Rate this question

Topics

Data Protection and Encryption

More questions from this topic