Examkin

Question

Difficulty: MediumAWS KMS and Encryption

An enterprise archiving application is designed to write raw sensor datasets (each averaging 500 KB500\text{ KB} in size) to a self-managed object store. The compliance team mandates client-side encryption before transmission. To minimize AWS KMS API requests and network latency, the development team plans to use local envelope encryption. Which sequence of AWS SDK operations represents the correct and most cost-effective implementation of this encryption workflow?

  1. Request a data key by calling `GenerateDataKey`. Use the returned plaintext data key to encrypt the dataset locally, immediately wipe the plaintext key from application memory, and store the dataset along with the returned ciphertext data key.Answer
  2. B
    Encrypt the dataset directly by calling `Encrypt` with the customer managed key, and then upload the resulting ciphertext to the object store.
  3. C
    Request only the encrypted key structure by calling `GenerateDataKeyWithoutPlaintext`. Use this returned ciphertext data key to perform the local encryption of the dataset.
  4. D
    Request a data key by calling `GenerateDataKey` to get a plaintext key. Use it to encrypt the dataset locally, then call `Encrypt` to encrypt that plaintext key, storing the resulting ciphertext key alongside the data.

Answer

Request a data key by calling `GenerateDataKey`, use the returned plaintext data key to encrypt the dataset locally, wipe the plaintext key from memory, and store the dataset alongside the returned ciphertext data key.
The correct workflow for client-side envelope encryption involves requesting a data key using `GenerateDataKey`. This operation returns both the plaintext key (for immediate encryption) and the encrypted ciphertext key (for storage). The plaintext key should be cleared from memory as soon as encryption completes.

Step-by-Step Solution

1
Analyze the file size constraint and encryption method.
The files average 500 KB500\text{ KB}, which exceeds the 4 KB4\text{ KB} payload limit of direct KMS `Encrypt` operations, confirming that envelope encryption is required.
Determines whether direct encryption or envelope encryption must be used.
2
Determine the correct API call to retrieve the necessary keys for envelope encryption.
Calling `GenerateDataKey` returns both a plaintext key (required to perform the encryption algorithm locally) and a ciphertext key (stored for later decryption).
Identifies the correct AWS KMS API operation that yields the cryptographic keys needed for client-side envelope encryption.
3
Review the workflow steps for security and cost efficiency.
Wiping the plaintext data key from memory immediately after encryption secures the system, and storing the returned ciphertext key directly avoids extra API calls (such as a redundant `Encrypt` call).
Ensures the application adheres to security best practices and minimizes AWS KMS cost and latency.

Key Concept

AWS KMS Envelope Encryption Workflow
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic