Examkin

Question

Difficulty: MediumData Protection and Encryption

A research laboratory is building a web application on AWS that handles sensitive clinical trials data. The regulatory authority requires the laboratory to encrypt all trial results at rest using dedicated, single-tenant hardware security modules (HSMs) that they control directly. They must also ensure that database credentials are encrypted and automatically rotated. Which of the following AWS services should the laboratory use to meet these requirements? (Select TWO.)

  1. AWS CloudHSMAnswer
  2. AWS Secrets ManagerAnswer
  3. C
    AWS Key Management Service (AWS KMS)
  4. D
    Amazon Inspector
  5. E
    AWS Shield

Answer

The research laboratory should use AWS CloudHSM to manage keys on dedicated, single-tenant hardware security modules, and AWS Secrets Manager to encrypt and automatically rotate database credentials.
To meet the compliance requirement for dedicated, single-tenant cryptographic hardware, the laboratory must use AWS CloudHSM. To encrypt and rotate database credentials, AWS Secrets Manager should be implemented.

Step-by-Step Solution

1
Analyze the requirement for dedicated, single-tenant cryptographic hardware.
Identify AWS CloudHSM as the correct service because AWS Key Management Service (AWS KMS) relies on shared, multi-tenant hardware security modules.
AWS CloudHSM is designed for compliance workloads that strictly require single-tenant dedicated HSM instances.
2
Analyze the requirement to encrypt and automatically rotate database credentials.
Identify AWS Secrets Manager as the service designed for securely storing and rotating credentials.
AWS Secrets Manager allows rotation configuration without deploying custom code or scripts.

Key Concept

Data Protection and Encryption services (AWS CloudHSM vs. AWS KMS) and secret management (AWS Secrets Manager).
Rate this question

Topics

Data Protection and Encryption

More questions from this topic