Examkin

Question

Difficulty: MediumData Protection and Encryption

A real estate platform is migrating its property transaction registry to AWS. The platform must encrypt all sensitive transaction records at rest using AWS Key Management Service (AWS KMS). Under the AWS Shared Responsibility Model, which of the following actions are the responsibility of the customer? (Select TWO.)

  1. Configuring key policies to control which IAM users and roles have permissions to use the KMS keysAnswer
  2. Selecting which specific datasets, files, or database tables are selected for encryptionAnswer
  3. C
    Managing the physical security and climate control of the data centers hosting the hardware security modules (HSMs)
  4. D
    Deploying and managing dedicated, single-tenant cryptographic hardware to host AWS KMS keys
  5. E
    Performing physical sanitization and decommissioning of storage media containing encrypted data

Answer

Under the AWS Shared Responsibility Model, the customer is responsible for configuring access permissions (key policies) to control usage of the encryption keys and selecting which specific resources (such as files, folders, or database tables) are encrypted. AWS is responsible for physical security of the data centers and the underlying multi-tenant infrastructure.
Configuring access permissions (key policies) and choosing which data components to encrypt are customer responsibilities because they belong to security 'in' the cloud. The customer maintains full ownership over data classification and key authorization rules.

Step-by-Step Solution

1
Analyze the service model of AWS KMS.
AWS KMS is a managed service where AWS manages the underlying hardware security modules (HSMs) and the multi-tenant virtualization layer, while the customer controls key usage and configuration.
This helps separate customer configuration tasks from AWS infrastructure management tasks.
2
Differentiate between customer responsibilities (security 'in' the cloud) and AWS responsibilities (security 'of' the cloud).
Customer tasks include configuring key policies and choosing what data to encrypt. AWS tasks include physical data center security, hardware maintenance, and media disposal.
Applying the Shared Responsibility Model allows identification of correct actions belonging to each party.

Key Concept

Under the AWS Shared Responsibility Model, the customer is responsible for data classification, choosing what to encrypt, and configuring key policies to manage access. AWS handles the physical security of the facilities, media sanitization, and underlying multi-tenant HSM infrastructure.
Estimated Time:1m 30s
Rate this question

Topics

Data Protection and Encryption

More questions from this topic