Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is building a high-throughput microservice that must encrypt data payloads (each approximately 2 MB2\text{ MB} in size) locally before storing them in an database. To implement envelope encryption efficiently and minimize network latency, the service needs to obtain a new symmetric key that contains both a plaintext version for immediate encryption and an encrypted version for storage alongside the data. Which AWS KMS API operation should the service call to receive both versions in a single request?

  1. GenerateDataKeyAnswer
  2. B
    GenerateDataKeyWithoutPlaintext
  3. C
    Encrypt
  4. D
    GenerateRandom

Answer

GenerateDataKey
The GenerateDataKey operation is designed for envelope encryption. It generates a unique data key and returns both a plaintext copy and an encrypted copy in a single response, matching the requirement to minimize network latency.

Step-by-Step Solution

1
Analyze the requirement to perform local envelope encryption on payloads of size 2 MB2\text{ MB} while minimizing network calls.
Determine that the application needs both a plaintext key to encrypt the payload locally and an encrypted version of that key to store with the data.
Since KMS cannot directly encrypt payloads larger than 4 KB4\text{ KB}, envelope encryption is required.
2
Evaluate the AWS KMS APIs for generating data keys.
Identify that GenerateDataKey returns both plaintext and ciphertext key representations, whereas GenerateDataKeyWithoutPlaintext returns only the ciphertext representation.
Choosing the correct API prevents unnecessary network roundtrips to decrypt the key.

Key Concept

AWS KMS Envelope Encryption Key Generation
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic