Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company is deploying a three-tier application on Amazon EC2. The database password must be stored securely and retrieved dynamically by the application. Additionally, the application's Amazon EBS volumes must be encrypted at rest using an AWS KMS customer managed key that undergoes automatic annual rotation, while ensuring that all existing snapshots remain readable. Which combination of actions will meet these requirements? (Select TWO.)

  1. A
    Store the database password in AWS Systems Manager Parameter Store as a parameter of type String.
  2. Store the database password in AWS Systems Manager Parameter Store as a parameter of type SecureString.Answer
  3. Enable automatic key rotation for the customer managed key in AWS KMS.Answer
  4. D
    Manually create a new customer managed key each year, associate it with the EBS volumes, and re-encrypt all historical snapshots.
  5. E
    Use the default AWS managed key aws/ebs for volume encryption and enable automatic rotation on it.

Answer

Storing the database password as a SecureString parameter in Systems Manager Parameter Store, and enabling automatic key rotation on the KMS customer managed key used for EBS volume encryption.
Storing the database password as a SecureString parameter in Systems Manager Parameter Store ensures that the password is encrypted at rest using a KMS key. Enabling automatic key rotation for the customer managed key in AWS KMS automatically rotates the key material annually. AWS KMS retains all historical backing key versions, allowing the system to seamlessly decrypt older snapshots encrypted with previous key versions without any manual re-encryption or reconfiguration.

Step-by-Step Solution

1
Configure secure storage for the database credentials using Systems Manager Parameter Store.
Create a parameter of type SecureString, which encrypts the password at rest using a KMS key.
This protects the sensitive credential from being stored in plaintext while allowing application instances to retrieve it dynamically.
2
Configure encryption at rest for the Amazon EBS volumes using a customer managed key.
Encrypt the EBS volumes using the specified customer managed key.
This meets the architectural requirement to use customer-managed encryption keys for storage volumes.
3
Enable automatic annual key rotation on the customer managed key in AWS KMS.
The KMS key material is rotated automatically every year, while keeping previous backing keys active.
This satisfies the rotation policy without requiring manual key updates or manual re-encryption of existing snapshots.

Key Concept

AWS KMS Customer Managed Key rotation mechanics and secure parameter storage using Systems Manager Parameter Store
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic