Examkin

Question

Difficulty: EasyAWS KMS and Encryption

A developer needs to encrypt a database password of size 2 KB2\text{ KB} directly using an AWS Key Management Service (AWS KMS) key. Which AWS KMS API operation should the developer call to encrypt this payload?

  1. A
    GenerateDataKey
  2. B
    PutParameter
  3. EncryptAnswer
  4. D
    GenerateDataKeyWithoutPlaintext

Answer

Encrypt
The Encrypt API operation is designed to encrypt small payloads (up to 4 KiB4\text{ KiB}) directly using a specified customer managed key or AWS managed key. Since the database password size is 2 KB2\text{ KB}, it fits within this limit and can be encrypted directly in a single API call.

Step-by-Step Solution

1
Determine the size of the payload to be encrypted.
The payload is 2 KB2\text{ KB}, which is under the 4 KiB4\text{ KiB} limit for direct encryption in AWS KMS.
AWS KMS allows direct encryption of small payloads up to 4 KiB4\text{ KiB} without requiring client-side envelope encryption.
2
Select the correct AWS KMS API operation that accepts a small plaintext payload and returns the ciphertext.
The Encrypt API operation is selected.
Calling Encrypt directly sends the plaintext payload to AWS KMS to be encrypted by the designated KMS key, returning the ciphertext.

Key Concept

Direct encryption of small payloads using the AWS KMS Encrypt API
Estimated Time:45s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic