Examkin

Question

Difficulty: EasyData Protection and Encryption

A travel booking platform is deploying a new application on AWS. To secure customer reservation records, the platform needs to encrypt data at rest within its storage services. The security team wants to use a fully managed service that creates and controls the cryptographic keys, rather than renting dedicated, single-tenant cryptographic hardware. Which AWS service is designed to meet this requirement?

  1. A
    AWS CloudHSM
  2. AWS Key Management Service (AWS KMS)Answer
  3. C
    AWS Secrets Manager
  4. D
    AWS Artifact

Answer

AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) is a fully managed, multi-tenant service that allows customers to easily create, manage, and control cryptographic keys. Because it is a multi-tenant service, the underlying hardware security modules are shared, making it the correct match for the scenario's requirements.

Step-by-Step Solution

1
Identify the key requirements in the scenario: encrypting data at rest using a fully managed, multi-tenant service without dedicated hardware.
The target service must handle key generation and administration under a shared multi-tenant model.
This helps differentiate between shared multi-tenant key management and dedicated single-tenant hardware security modules.
2
Select the service that manages cryptographic keys in a multi-tenant configuration.
AWS Key Management Service (AWS KMS) fits this description, whereas AWS CloudHSM provides dedicated single-tenant HSMs.
This aligns the service architecture with the company's preferences.

Key Concept

AWS Key Management Service (AWS KMS) provides fully managed, multi-tenant cryptographic key management for encrypting data at rest.
Rate this question

Topics

Data Protection and Encryption

More questions from this topic