Examkin

Question

Difficulty: MediumData Protection and Encryption

A telecommunications company is migrating its customer billing system to AWS. The security policy mandates that all database backups stored in Amazon S3 must be encrypted at rest using encryption keys managed within dedicated, single-tenant hardware security modules (HSMs) to comply with local regulations. Additionally, the company wants to ensure this encryption strategy complies with the AWS Shared Responsibility Model.

Which of the following options correctly identify a service or responsibility required for this architecture? (Select TWO.)

  1. AWS CloudHSM to manage the encryption keys on dedicated, single-tenant hardware security modules.Answer
  2. The customer's responsibility to configure the server-side encryption settings on the Amazon S3 buckets.Answer
  3. C
    AWS Key Management Service (AWS KMS) with AWS-managed keys to provide dedicated, single-tenant cryptographic storage.
  4. D
    AWS's responsibility to automatically configure and enable encryption on all customer-created Amazon S3 buckets.
  5. E
    AWS Certificate Manager (ACM) to generate and rotate symmetric encryption keys for data at rest.

Answer

AWS CloudHSM to manage the encryption keys on dedicated, single-tenant hardware security modules, and the customer's responsibility to configure the server-side encryption settings on the Amazon S3 buckets.
AWS CloudHSM provides dedicated, single-tenant hardware security modules (HSMs) directly under the customer's control, which satisfies the compliance requirement. Additionally, under the Shared Responsibility Model, configuring data protection settings like server-side encryption on Amazon S3 buckets falls under the customer's responsibility (security in the cloud).

Step-by-Step Solution

1
Identify the key management service required for dedicated, single-tenant cryptographic hardware.
AWS CloudHSM is selected because it provides dedicated, single-tenant HSM instances, unlike AWS KMS which is a multi-tenant service.
The scenario requires single-tenant cryptographic hardware to comply with local regulations.
2
Determine the party responsible for configuring encryption on Amazon S3 buckets under the AWS Shared Responsibility Model.
Configuring S3 encryption is classified as a customer responsibility (security in the cloud).
Under the Shared Responsibility Model, AWS secures the infrastructure, but the customer is responsible for configuring data protection controls such as bucket policies and encryption settings.

Key Concept

AWS CloudHSM vs AWS KMS single-tenant requirements and the customer's role in data encryption under the AWS Shared Responsibility Model
Estimated Time:1m 30s
Rate this question

Topics

Data Protection and Encryption

More questions from this topic