Examkin

Question

Difficulty: HardData Protection and Encryption

A retail corporation is designing a hybrid cloud architecture and needs to secure its data at rest on AWS. The security compliance policy states that the keys used for encrypting financial transactions must be stored on dedicated, single-tenant cryptographic hardware controlled entirely by the customer. However, for standard application logs stored in Amazon S3, the company wants to use a fully managed service where AWS handles the physical hardware management, but the customer retains control over key policies and rotation.

Which two of the following actions should the company take to meet these requirements? (Select TWO.)

  1. Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions.Answer
  2. Use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.Answer
  3. C
    Use AWS Key Management Service (AWS KMS) custom key stores to host the financial transactions' encryption keys on shared, multi-tenant hardware managed by AWS.
  4. D
    Configure Amazon S3 managed keys (SSE-S3) to manage key rotation policies and access permissions for the CloudHSM cluster.
  5. E
    Configure AWS support to manage the internal database users, credentials, and key backups inside the CloudHSM cluster.

Answer

Provision AWS CloudHSM to manage the cryptographic keys for the financial transactions, and use AWS Key Management Service (AWS KMS) with customer managed keys to encrypt the application logs.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys. AWS CloudHSM satisfies the need for dedicated, single-tenant hardware cryptographic keys controlled entirely by the customer. AWS KMS with customer managed keys satisfies the requirement for a fully managed multi-tenant key service where AWS manages the underlying HSM hardware while the customer retains control over key policies and key rotation.

Step-by-Step Solution

1
Analyze the encryption requirements for the financial transaction keys.
The requirement specifies dedicated, single-tenant cryptographic hardware controlled entirely by the customer, which points directly to AWS CloudHSM.
AWS CloudHSM is a dedicated HSM service that gives the customer exclusive administrative control.
2
Analyze the encryption requirements for the application logs stored in Amazon S3.
The requirement specifies a fully managed service where AWS manages the hardware, but the customer controls key policies and rotation. This aligns with AWS KMS customer managed keys.
AWS KMS customer managed keys are managed by the customer but run on AWS-managed multi-tenant HSM infrastructure.
3
Select the correct combination of AWS services that fulfill both conditions.
The correct options are provisioning AWS CloudHSM and using AWS KMS with customer managed keys.
This combination successfully meets both dedicated and fully-managed encryption needs.

Key Concept

Selecting appropriate AWS services (AWS KMS vs. AWS CloudHSM) based on multi-tenant versus single-tenant encryption hardware requirements under the shared responsibility model.
Rate this question

Topics

Data Protection and Encryption

More questions from this topic