Examkin

Question

Difficulty: HardData Protection and Encryption

A healthcare provider plans to store patient medical records in Amazon Simple Storage Service (Amazon S3) and must encrypt the data at rest to comply with regulatory standards. The provider wants to control their own encryption keys but wishes to avoid the operational overhead of provisioning, configuring, and maintaining dedicated, single-tenant hardware. Which solution and division of responsibility meets these requirements?

  1. Using AWS Key Management Service (KMS) with customer managed keys, where the customer manages the key policies and rotation configuration, while AWS manages the physical security, maintenance, and availability of the underlying multi-tenant HSMs.Answer
  2. B
    Using AWS CloudHSM, where AWS manages the cryptographic user accounts and key generation, while the customer is responsible for patching and maintaining the physical HSM appliances.
  3. C
    Using AWS Key Management Service (KMS), where the customer is responsible for upgrading the firmware and maintaining physical security of the multi-tenant HSMs, while AWS manages the key policies.
  4. D
    Using AWS CloudHSM, where AWS manages the encryption policies and key replication, while the customer maintains the physical power supply and rack mounting of the HSM hardware.

Answer

Using AWS Key Management Service (KMS) with customer managed keys, where the customer manages the key policies and rotation configuration, while AWS manages the physical security, maintenance, and availability of the underlying multi-tenant HSMs.
The correct option correctly identifies that using AWS Key Management Service (KMS) with customer managed keys satisfies the requirements. AWS KMS is a multi-tenant service where AWS manages the hardware, provisioning, patching, and physical security, minimizing customer operational overhead. At the same time, the customer retains control over key policies, access permissions, and key rotation. This satisfies both the need for key control and low overhead.

Step-by-Step Solution

1
Analyze the business requirements to determine key management needs.
The scenario requires data encryption at rest under customer control, but explicitly specifies avoiding the operational overhead of dedicated single-tenant hardware.
This rules out AWS CloudHSM, which provides dedicated single-tenant HSM appliances that require significant customer administrative effort, and points to AWS Key Management Service (KMS) as the appropriate service.
2
Apply the AWS shared responsibility model to key management in AWS KMS.
For AWS KMS customer managed keys, the customer is responsible for logical controls such as defining key policies, key usage permissions, and scheduling rotation. AWS is responsible for the physical security, patching, scaling, and availability of the underlying multi-tenant HSM infrastructure.
This establishes the correct boundary of responsibility, identifying that physical maintenance of HSMs is always managed by AWS.

Key Concept

Shared responsibility model for data encryption at rest using AWS Key Management Service (KMS) versus AWS CloudHSM.
Rate this question

Topics

Data Protection and Encryption

More questions from this topic