Examkin

Question

Difficulty: HardData Protection and Encryption

A financial institution is deploying a payment gateway on AWS. The institution's compliance policy dictates that all customer transactions must be encrypted at rest using single-tenant cryptographic hardware under the institution's exclusive control. Additionally, all transactional data must be encrypted in transit across all application tiers.

Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer to meet these security requirements? (Select TWO.)

  1. Generating and managing the cryptographic keys and user accounts within an AWS CloudHSM instanceAnswer
  2. B
    Securing the physical infrastructure and power supply of the host data centers housing the cryptographic hardware
  3. C
    Configuring AWS Key Management Service (AWS KMS) to provide dedicated, single-tenant hardware security modules (HSMs)
  4. Configuring SSL/TLS parameters to secure data in transit between application layersAnswer
  5. E
    Managing the physical lifecycle and firmware updates of the hardware security modules (HSMs)

Answer

Generating and managing the cryptographic keys and user accounts within an AWS CloudHSM instance, and configuring SSL/TLS parameters to secure data in transit between application layers.
Generating and managing keys inside AWS CloudHSM is a customer responsibility because CloudHSM provides dedicated cryptographic hardware where the customer has sole control over keys and users. Configuring SSL/TLS parameters for data in transit is also a customer responsibility because it is configured at the application and operating system level, which falls under customer control in the AWS Shared Responsibility Model.

Step-by-Step Solution

1
Identify key management requirements.
The scenario requires dedicated, single-tenant cryptographic hardware under exclusive control. This points to AWS CloudHSM.
AWS CloudHSM provides dedicated, single-tenant hardware security modules where the customer manages the keys and users, unlike AWS KMS which is multi-tenant by default.
2
Identify data in transit requirements.
Securing data in transit requires SSL/TLS configuration between application layers.
Encrypting data in transit is handled by configuring secure communication protocols (like SSL/TLS) at the operating system or application tier, which are managed by the customer.
3
Differentiate customer responsibilities from AWS responsibilities.
AWS handles physical security, hardware lifecycle, and hypervisor security, while the customer handles data configuration, encryption settings, and key management inside their instances.
Under the Shared Responsibility Model, AWS is responsible for security 'of' the cloud (physical data centers, hardware infrastructure), and the customer is responsible for security 'in' the cloud (data encryption, network traffic protection).

Key Concept

Under the AWS Shared Responsibility Model, the customer is responsible for configuring encryption in transit (SSL/TLS) and managing their cryptographic keys and user accounts within single-tenant hardware like AWS CloudHSM, while AWS handles physical infrastructure and hardware maintenance.
Estimated Time:2m 0s
Rate this question

Topics

Data Protection and Encryption

More questions from this topic