Examkin

Question

Difficulty: EasyAWS KMS and Encryption

A developer is implementing client-side envelope encryption to secure local data files of size 10 MB10\text{ MB}. The developer calls the AWS KMS `GenerateDataKey` API operation. What does this API operation return to the developer's application?

  1. A
    Only the encrypted ciphertext data key
  2. Both the plaintext data key and the encrypted ciphertext data keyAnswer
  3. C
    The plaintext data key and the customer managed key
  4. D
    The encrypted data payload and the plaintext data key

Answer

Both the plaintext data key and the encrypted ciphertext data key
The GenerateDataKey API operation returns both a plaintext copy of the data key (used to encrypt the file locally in memory) and a ciphertext copy of the data key (encrypted with the specified KMS key, which is saved alongside the encrypted data for later decryption).

Step-by-Step Solution

1
Determine the operational mechanism of envelope encryption for large files.
Envelope encryption requires generating a temporary symmetric data key that will be used to encrypt the payload locally.
Direct encryption using KMS keys is limited to payloads of 4 KB4\text{ KB} or less, meaning a 10 MB10\text{ MB} file must be encrypted using envelope encryption.
2
Analyze the output of the GenerateDataKey API operation.
The GenerateDataKey operation creates a unique data key, encrypts it under the customer managed key, and returns both the plaintext key and the encrypted ciphertext key.
The application needs the plaintext key to encrypt the file immediately, and the ciphertext key to save next to the encrypted file so it can be decrypted later.
3
Match the generated API outputs to the options provided.
The option stating that both the plaintext data key and the encrypted ciphertext data key are returned is correct.
It matches the exact response schema of the GenerateDataKey API call.

Key Concept

AWS KMS Envelope Encryption Workflow
Estimated Time:45s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic