Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is building a compliance utility that runs on an Amazon EC2 instance. The utility must encrypt database backup files of approximately 250 MB250\text{ MB} client-side before sending them to an external partner's storage server. The developer wants to use envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS.

Which TWO actions must the developer perform in the application code to implement this client-side encryption workflow? (Select TWO.)

  1. Call the GenerateDataKey API operation of AWS KMS, specifying the Customer Managed Key, to retrieve both a plaintext data key and an encrypted copy of the data key.Answer
  2. Encrypt the backup file locally using the plaintext data key, immediately delete the plaintext data key from memory, and package the encrypted data key alongside the encrypted backup file.Answer
  3. C
    Call the Encrypt API operation of AWS KMS, passing the database backup file payload directly to KMS, to retrieve the encrypted ciphertext.
  4. D
    Call the GenerateDataKeyWithoutPlaintext API operation of AWS KMS, and use the returned ciphertext data key to encrypt the database backup file.
  5. E
    Store the database backup file in AWS Secrets Manager, and configure Secrets Manager to automatically rotate the data key after each backup operation.

Answer

Calling the GenerateDataKey API to obtain both the plaintext and encrypted data keys, encrypting the backup file locally with the plaintext key, and then deleting the plaintext key from memory while storing the encrypted key with the ciphertext.
For client-side envelope encryption, the developer must call the GenerateDataKey API to obtain both the plaintext data key and the encrypted version of the data key. The plaintext key is used to perform the actual local encryption of the large 250 MB250\text{ MB} backup file. Once the encryption completes, the plaintext data key must be discarded from the system memory. The encrypted data key is then stored or sent alongside the ciphertext so that it can be used for decryption in the future.

Step-by-Step Solution

1
Generate the data keys using AWS KMS.
The application calls the GenerateDataKey API with the CMK. KMS returns a plaintext data key and an encrypted data key.
This establishes the unique keys needed for local symmetric encryption without sending large payloads to KMS.
2
Perform local symmetric encryption.
The application encrypts the 250 MB250\text{ MB} database backup file using the plaintext data key with a standard library (e.g., AES-256).
Symmetric encryption handles large datasets efficiently and keeps data secure before transit.
3
Clean up memory and prepare the payload.
The plaintext data key is deleted from the application memory. The encrypted backup file and the encrypted data key are packaged together.
Removing the plaintext key from memory prevents unauthorized access. The encrypted data key is required later to decrypt the file.

Key Concept

AWS KMS Envelope Encryption Workflow
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic