Examkin

Question

Difficulty: EasyAWS KMS and Encryption

A developer is designing a client-side encryption solution for a custom application. The application will use envelope encryption to secure data packets before storing them. The developer calls the AWS KMS `GenerateDataKey` API operation.

Which components does AWS KMS return to the application in the API response?

  1. A
    The plaintext data key and the encrypted data payload
  2. A plaintext data key and a ciphertext data keyAnswer
  3. C
    A ciphertext data key and the encrypted data payload
  4. D
    A plaintext data key and a Systems Manager parameter reference

Answer

A plaintext data key and a ciphertext data key
The correct option is the one stating that a plaintext data key and a ciphertext data key are returned. The `GenerateDataKey` operation is designed to support client-side envelope encryption by providing a plaintext key for immediate encryption by the client application, and a ciphertext key that can be safely stored alongside the encrypted data.

Step-by-Step Solution

1
Analyze the request to use envelope encryption via the `GenerateDataKey` API operation.
The application needs to encrypt data locally, which requires a data key generated by AWS KMS.
Envelope encryption relies on a data key generated by a root key (KMS Customer Managed Key) to encrypt the actual data.
2
Identify the outputs returned by the `GenerateDataKey` operation.
AWS KMS returns two parts: a plaintext data key for immediate encryption, and a ciphertext data key for storage.
The plaintext key is used to encrypt the data locally and then deleted from memory. The ciphertext key is stored with the encrypted data so it can be decrypted later by calling the KMS Decrypt API.

Key Concept

AWS KMS Envelope Encryption and the GenerateDataKey API
Estimated Time:45s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic