Examkin

Question

Difficulty: HardData Protection and Encryption

A utility company is deploying an IoT smart-grid application on AWS. The application ingests telemetry data from millions of smart meters over the public internet and stores the processed records in an Amazon S3 bucket. The company's compliance policy requires all data to be encrypted both in transit and at rest.

According to the AWS Shared Responsibility Model, which of the following actions are the responsibility of the customer to meet these security requirements? (Select TWO.)

  1. Configuring SSL/TLS for data ingestion to protect telemetry data in transit.Answer
  2. Enabling Amazon S3 server-side encryption using customer-managed keys in AWS KMS.Answer
  3. C
    Upkeep and physical maintenance of the hardware security modules (HSMs) hosting AWS KMS keys.
  4. D
    Deploying dedicated physical HSM appliances within the AWS region for multi-tenant KMS key storage.
  5. E
    Managing the network infrastructure and routers that encrypt data moving between AWS Availability Zones.

Answer

Configuring SSL/TLS for data ingestion to protect telemetry data in transit, and enabling Amazon S3 server-side encryption using customer-managed keys in AWS KMS.
The customer is responsible for configuring encryption of data in transit (such as enforcing SSL/TLS protocols for data ingestion) and implementing encryption at rest for stored data (such as enabling Amazon S3 server-side encryption using KMS keys). Under the Shared Responsibility Model, AWS manages the security 'of' the cloud, including physical security of data centers, host infrastructure, and underlying managed encryption hardware, while the customer manages security 'in' the cloud, including data configuration and access policies.

Step-by-Step Solution

1
Analyze the Shared Responsibility Model for encryption in transit.
Identify that configuring secure ingestion protocols (like SSL/TLS) over the public internet to AWS endpoints is the customer's responsibility to protect data in transit.
AWS secures the ingestion endpoints, but configuring the client devices and setting up SSL/TLS connections to those endpoints is managed by the customer.
2
Analyze the Shared Responsibility Model for encryption at rest.
Identify that enabling encryption on storage services like Amazon S3 and configuring the KMS keys used for that encryption is the customer's responsibility.
AWS provides the encryption features and tools, but the customer must choose to enable them and define the key policies.
3
Evaluate the infrastructure-related options to eliminate AWS-managed tasks.
Exclude physical HSM upkeep, dedicated HSM deployment for KMS, and intra-AZ network infrastructure management, as these are managed by AWS.
AWS is responsible for the physical security, hardware maintenance, and global networking infrastructure.

Key Concept

Under the AWS Shared Responsibility Model, the customer is responsible for data security configurations, which include configuring SSL/TLS protocols for data in transit and enabling server-side encryption at rest (such as in Amazon S3) using KMS keys. AWS is responsible for the security of the underlying infrastructure, including physical networking, hosting hosts, and the physical HSMs utilized by managed services.
Rate this question

Topics

Data Protection and Encryption

More questions from this topic