Examkin

Question

Difficulty: HardData Protection and Encryption

A pharmaceutical research firm must encrypt clinical trial data stored in Amazon S3. The firm's compliance policy mandates that encryption keys must be generated and stored on dedicated, single-tenant hardware security modules (HSMs) directly controlled by the firm's security team. However, the firm still wants to leverage the automated, seamless server-side encryption features of Amazon S3 without custom application-side coding. Which of the following approaches meets these requirements?

  1. Configure AWS Key Management Service (KMS) with a custom key store backed by an AWS CloudHSM cluster, and use those keys for S3 server-side encryption (SSE-KMS).Answer
  2. B
    Encrypt the data on the client side using the AWS CloudHSM client software before uploading it to Amazon S3.
  3. C
    Use AWS Key Management Service (KMS) with default AWS managed keys (SSE-KMS), and configure AWS CloudTrail to copy the keys to a CloudHSM cluster for single-tenant backup.
  4. D
    Enable Amazon S3 server-side encryption with customer-provided keys (SSE-C) and have AWS automatically manage the lifecycle of the keys inside AWS KMS.

Answer

Configure AWS Key Management Service (KMS) with a custom key store backed by an AWS CloudHSM cluster, and use those keys for S3 server-side encryption (SSE-KMS).
The correct approach is to configure AWS Key Management Service (KMS) with a custom key store backed by an AWS CloudHSM cluster, and use those keys for S3 server-side encryption (SSE-KMS). This allows the customer to maintain sole ownership and control of the keys in a dedicated, single-tenant HSM cluster (AWS CloudHSM) while still allowing Amazon S3 to perform transparent server-side encryption via KMS integrations.

Step-by-Step Solution

1
Identify the primary compliance requirement for key control.
Encryption keys must be generated and stored on dedicated, single-tenant hardware security modules (HSMs) directly controlled by the firm.
This requirement identifies AWS CloudHSM as the necessary hardware boundary, rather than standard AWS KMS multi-tenant key storage.
2
Identify the operational integration requirement.
The firm wants to use S3's automated server-side encryption without custom application-side coding.
This rules out client-side encryption and requires a solution that integrates natively with S3 server-side encryption (SSE).
3
Determine the integration path between AWS CloudHSM and Amazon S3.
S3 cannot directly interact with AWS CloudHSM. AWS KMS must act as the intermediary using a Custom Key Store backed by the AWS CloudHSM cluster.
Using a KMS Custom Key Store allows S3 to request encryption via SSE-KMS, while KMS offloads the cryptographic operations and key storage to the user-controlled CloudHSM cluster.

Key Concept

AWS KMS Custom Key Stores
Rate this question

Topics

Data Protection and Encryption

More questions from this topic