Examkin

Question

Difficulty: EasyAWS KMS and Encryption

A developer is building a healthcare application that processes patient medical images. Each image file is approximately 25 MB25\text{ MB} in size. The developer needs to encrypt these images locally using client-side envelope encryption with an AWS KMS customer managed key before uploading them to an Amazon S3 bucket.

Which of the following steps must the developer perform to complete this encryption process? (Select TWO.)

  1. Call the AWS KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key.Answer
  2. Encrypt the medical image file locally using the plaintext data key, and then delete the plaintext data key from memory.Answer
  3. C
    Call the AWS KMS Encrypt API operation to encrypt the entire image file directly in the cloud.
  4. D
    Upload the plaintext data key to AWS Secrets Manager to make it available for future decryption operations.
  5. E
    Export the private key material of the KMS customer managed key to perform the encryption on the local server.

Answer

To perform client-side envelope encryption, the developer must call the AWS KMS GenerateDataKey operation to retrieve a plaintext data key and an encrypted data key, encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.
The correct workflow for client-side envelope encryption requires generating a data key using the GenerateDataKey API operation. This provides a plaintext data key to perform the local symmetric encryption on the 25 MB25\text{ MB} image and an encrypted data key. Once the file is encrypted, the plaintext data key must be removed from memory to ensure security.

Step-by-Step Solution

1
Call the GenerateDataKey API operation.
AWS KMS returns a plaintext data key and an encrypted data key.
The plaintext data key is required to perform the local encryption, and the encrypted data key will be stored alongside the encrypted file.
2
Perform local encryption using a cryptographic library.
The medical image file is encrypted locally.
Since the file exceeds the 4 KB4\text{ KB} limit of the KMS Encrypt API, the encryption must be handled locally on the application host.
3
Delete the plaintext data key from memory and package the encrypted key with the ciphertext.
The plaintext key is removed, and the encrypted data key is saved with the encrypted image.
Removing the plaintext data key from memory prevents security risks. Storing the encrypted data key alongside the ciphertext is necessary for future decryption.

Key Concept

AWS KMS client-side envelope encryption workflow for payloads exceeding the KMS API size limits.
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic