Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is building a sensitive medical telemetry ingestion application. The application receives health records (each approximately 120 KB120\text{ KB} in size) that must be encrypted client-side using envelope encryption before being stored in Amazon DynamoDB. The developer needs to implement this workflow using the AWS SDK and a customer managed key in AWS KMS.

Which two steps must the developer perform to encrypt and store each health record? (Select TWO.)

  1. Call the AWS KMS GenerateDataKey API using the customer managed key to receive both a plaintext data key and an encrypted data key.Answer
  2. B
    Call the AWS KMS Encrypt API directly to encrypt each 120 KB120\text{ KB} health record, then store the resulting ciphertext in DynamoDB.
  3. C
    Call the AWS KMS GenerateDataKeyWithoutPlaintext API to retrieve an encrypted data key, then decrypt this key locally using a local private key.
  4. Encrypt the health record payload locally using the plaintext data key, erase the plaintext key from memory, and store the encrypted payload along with the encrypted data key in DynamoDB.Answer
  5. E
    Store the generated plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to share it with other application components.

Answer

To secure the payloads, the developer must call the GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the health record locally, and then it is discarded from memory. The encrypted payload and the encrypted data key are then stored together in DynamoDB.
The correct workflow for client-side envelope encryption requires obtaining both a plaintext key and an encrypted key via the GenerateDataKey API. The plaintext key is used to perform the local encryption of the health record, and then it is immediately discarded from memory to prevent exposure. The encrypted data key and the encrypted payload are stored together in the database, allowing authorized users to decrypt the payload by first decrypting the key via KMS.

Step-by-Step Solution

1
Request a data key from AWS KMS.
The GenerateDataKey API returns a plaintext data key and an encrypted data key (ciphertext).
The plaintext key is required for local encryption, while the encrypted key is stored alongside the encrypted data for future decryption.
2
Encrypt the payload locally and clean up memory.
The 120 KB120\text{ KB} payload is encrypted using the plaintext data key, and the plaintext key is deleted from the application's memory.
This implements client-side envelope encryption and ensures that plaintext keys do not persist in memory, minimizing exposure risk.
3
Save the encrypted assets to Amazon DynamoDB.
The ciphertext payload and the encrypted data key are written to the database.
During decryption, the encrypted data key can be sent back to AWS KMS to retrieve the plaintext key needed to decrypt the payload.

Key Concept

AWS KMS Envelope Encryption
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic