Examkin

Question

Difficulty: Very hardData Protection and Encryption

A genomic research institute stores patient DNA sequencing data in Amazon S3 and runs analysis workloads on Amazon EC2. The institute's compliance guidelines state that:
1. The cryptographic keys used for encrypting the data at rest must be managed on dedicated, single-tenant hardware security modules (HSMs) where the customer has sole control over cryptographic web users and key policies.
2. All data in transit between the EC2 instances and the S3 buckets must be encrypted using Transport Layer Security (TLS).

Which of the following implementation details are correct? (Select TWO.)

  1. The customer must deploy AWS CloudHSM to manage encryption keys to satisfy the dedicated, single-tenant hardware module requirement.Answer
  2. The customer is responsible for configuring bucket policies that enforce HTTPS (TLS) connections to secure data in transit to Amazon S3.Answer
  3. C
    The customer can use AWS Key Management Service (AWS KMS) with AWS-managed keys to satisfy the dedicated, single-tenant hardware module requirement.
  4. D
    AWS is responsible for automatically managing client-side TLS configurations and enforcing encrypted connections on the EC2 instances.
  5. E
    AWS automatically manages and defines the cryptographic web users inside the AWS CloudHSM instances on behalf of the customer.

Answer

The customer must deploy AWS CloudHSM to manage encryption keys to satisfy the dedicated, single-tenant hardware module requirement, and the customer is responsible for configuring S3 bucket policies that enforce HTTPS (TLS) connections to secure data in transit.
The correct implementation requires AWS CloudHSM because it is a dedicated, single-tenant HSM service that gives the customer exclusive cryptographic control over keys and users. Additionally, under the Shared Responsibility Model, configuring bucket policies to enforce TLS for data in transit is a customer-side responsibility.

Step-by-Step Solution

1
Analyze the at-rest encryption requirements for single-tenant, dedicated HSM hardware.
Determine that AWS Key Management Service (AWS KMS) is a shared, multi-tenant service and does not meet this requirement, whereas AWS CloudHSM provides dedicated single-tenant HSM instances.
This isolates the correct key management service required for compliance.
2
Analyze the in-transit encryption requirement under the Shared Responsibility Model.
Recognize that while AWS provides the network infrastructure and endpoints, the customer must configure their applications and S3 bucket policies to require HTTPS/TLS.
This establishes correct ownership of configurations for data in transit.

Key Concept

Understanding the difference between multi-tenant AWS KMS and single-tenant AWS CloudHSM, and mapping the customer's responsibility for configuring encryption in transit under the AWS Shared Responsibility Model.
Rate this question

Topics

Data Protection and Encryption

More questions from this topic