Examkin

Question

Difficulty: HardData Protection and Encryption

A logistics company is migrating its supply chain database to AWS. The compliance team requires that all data stored at rest in Amazon S3 be encrypted. The compliance policy specifically mandates that the encryption keys must be generated and stored in a dedicated, single-tenant cryptographic hardware appliance that the company fully controls, while AWS remains responsible for the physical security and maintenance of the appliance hardware. Which service and management model should the company implement?

  1. A
    AWS CloudHSM, where the customer assumes responsibility for both the physical security of the HSM hardware and the administration of the cryptographic partitions.
  2. AWS CloudHSM to manage the keys, where the customer retains exclusive administrative control of the cryptographic users and AWS manages the physical appliance.Answer
  3. C
    AWS Key Management Service (AWS KMS) with customer-managed keys, because AWS KMS provides dedicated, single-tenant cryptographic hardware for each AWS account.
  4. D
    AWS Key Management Service (AWS KMS) with AWS-managed keys, where AWS manages both the logical key administration and the physical security of the dedicated hardware.

Answer

AWS CloudHSM to manage the keys, where the customer retains exclusive administrative control of the cryptographic users and AWS manages the physical appliance.
The correct option meets the requirement of single-tenancy and correctly maps the shared responsibility model. AWS CloudHSM provides dedicated, single-tenant hardware security modules (HSMs). The customer has sole control over key generation and user administration on the partition, while AWS maintains physical security, power, cooling, and hardware replacement of the HSM appliance.

Step-by-Step Solution

1
Identify the multi-tenancy and single-tenancy requirements for key management.
The scenario requires a dedicated, single-tenant hardware appliance, which points to AWS CloudHSM rather than AWS Key Management Service (AWS KMS), which is a multi-tenant service.
AWS CloudHSM provides dedicated access to physical HSMs, whereas AWS KMS shares HSM infrastructure across multiple AWS accounts.
2
Apply the AWS Shared Responsibility Model to the chosen service.
AWS is responsible for physical security and hardware maintenance of the CloudHSM appliances, while the customer is responsible for administering HSM users and managing the keys.
Customers cannot physically access AWS data centers, so physical host security and appliance maintenance remain AWS's responsibility under the shared responsibility model.

Key Concept

AWS CloudHSM vs AWS KMS and the Shared Responsibility Model for Data Protection
Rate this question

Topics

Data Protection and Encryption

More questions from this topic