Examkin

Question

Difficulty: MediumData Protection and Encryption

A healthcare enterprise needs to store sensitive patient files on Amazon S3. To meet compliance regulations, they require encryption at rest using dedicated, single-tenant cryptographic hardware where they maintain full control over the administration of the hardware security modules (HSMs). Which AWS service or feature should the enterprise configure to manage their encryption keys?

  1. A
    AWS Key Management Service (AWS KMS)
  2. AWS CloudHSMAnswer
  3. C
    Amazon S3 Managed Keys (SSE-S3)
  4. D
    AWS Artifact

Answer

AWS CloudHSM
AWS CloudHSM is the correct choice because it provides dedicated, single-tenant hardware security module (HSM) instances within the customer's VPC. This gives the customer exclusive administrative control over the keys and cryptographic operations, satisfying the strict compliance constraint.

Step-by-Step Solution

1
Analyze the customer requirements for encryption at rest.
The customer needs dedicated, single-tenant cryptographic hardware (HSMs) and full administrative control over the keys.
This determines whether a multi-tenant managed service (like AWS KMS) or a dedicated single-tenant solution (like AWS CloudHSM) is required.
2
Compare AWS encryption and key management services against the requirements.
AWS CloudHSM satisfies the single-tenant dedicated hardware requirement, whereas AWS KMS uses shared multi-tenant HSMs. SSE-S3 is fully managed by AWS on shared storage, and AWS Artifact is only for compliance documents.
Selecting the service that matches the dedicated, single-tenant hardware and customer control criteria leads to the correct answer.

Key Concept

Dedicated single-tenant hardware security modules (CloudHSM) versus managed multi-tenant key management (KMS).
Estimated Time:1m 0s
Rate this question

Topics

Data Protection and Encryption

More questions from this topic