Examkin

Question

Difficulty: MediumData Encryption and Key Management

A solutions architect is designing a secure architecture for a microservice-based payment application. The application must securely store API keys for a third-party payment gateway. Additionally, the application requires encrypting customer profiles stored in an Amazon DynamoDB table using a customer managed key (CMK) that is automatically rotated. The company requires that historical data encrypted under the CMK remains readable after rotation without manual intervention or data re-encryption. Which TWO actions should the solutions architect take to meet these security requirements? (Select TWO.)

  1. Store the payment gateway API keys in AWS Secrets Manager and configure automatic rotation for the secrets.Answer
  2. Create a symmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this key.Answer
  3. C
    Store the payment gateway API keys in AWS Systems Manager Parameter Store as a parameter of type String.
  4. D
    Create an asymmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this key.
  5. E
    Create a symmetric customer managed key (CMK) in AWS KMS, enable automatic key rotation, and execute a custom script to decrypt and re-encrypt all historical DynamoDB items under the new key version.

Answer

Store the API keys in AWS Secrets Manager with automatic rotation, and use a symmetric customer managed key in AWS KMS with automatic key rotation enabled for the DynamoDB table.
The correct options are to store the API keys in AWS Secrets Manager and to use a symmetric customer managed KMS key with automatic key rotation enabled for DynamoDB. Secrets Manager securely stores and automatically rotates API keys. A symmetric customer managed KMS key is the correct key type for DynamoDB encryption and supports automatic key rotation. Since KMS transparently keeps the older key versions to decrypt historical data, no manual re-encryption is required.

Step-by-Step Solution

1
Select a secure storage solution for third-party API keys.
AWS Secrets Manager is chosen because it securely encrypts secrets at rest and supports built-in automatic rotation.
Storing credentials in plaintext (like SSM Parameter Store String type) is insecure, while Secrets Manager provides secure lifecycle management for API keys.
2
Select the correct KMS key type and rotation policy for DynamoDB.
A symmetric customer managed KMS key with automatic rotation enabled is configured.
DynamoDB supports encryption at rest with KMS keys. Symmetrical KMS keys support automatic annual rotation, whereas asymmetric keys do not support automatic rotation.
3
Evaluate decryption requirements for historical data.
Verify that no manual re-encryption is needed.
AWS KMS automatically retains the older backing key material to decrypt historical data encrypted under previous versions of the key.

Key Concept

AWS KMS automatic rotation for symmetric keys automatically retains older key versions to decrypt historical data, and AWS Secrets Manager provides secure storage and rotation for API credentials.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic