Examkin

Question

Difficulty: MediumData Encryption and Key Management

A healthcare provider hosts a web portal on AWS that stores patient medical imaging files in an Amazon S3 bucket and patient metadata in an Amazon Aurora PostgreSQL database. The provider's compliance policy mandates that all data at rest must be encrypted using customer managed keys in AWS Key Management Service (AWS KMS). The cryptographic key material must be updated annually, but existing data must not be actively re-encrypted. Additionally, the database credentials must be rotated every 30 days without causing database connection issues or application downtime. Which combination of actions will meet these requirements in the most secure manner? (Select TWO.)

  1. Enable automatic key rotation on the customer managed keys in AWS KMS.Answer
  2. Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function every 30 days.Answer
  3. C
    Store the database credentials as a String parameter in AWS Systems Manager Parameter Store and write a custom script to rotate the password.
  4. D
    Enable automatic key rotation in AWS KMS and execute an AWS Batch job to immediately re-encrypt all existing data with the new key version.
  5. E
    Manually create a new customer managed key annually to replace the active key, and delete the previous customer managed key to prevent its unauthorized use.

Answer

Enable automatic key rotation on the customer managed keys in AWS KMS, and store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function every 30 days.
Enabling automatic key rotation for customer managed keys satisfies the annual rotation requirement without re-encrypting existing data because AWS KMS automatically retains older key versions to decrypt historical data. Storing database credentials in AWS Secrets Manager and using an AWS Lambda function to rotate the credentials every 30 days satisfies the rotation requirement while avoiding application downtime or connection issues.

Step-by-Step Solution

1
Address the KMS key rotation requirement.
Enable automatic key rotation on the customer managed keys in AWS KMS. This rotates key material annually and retains old key material to decrypt old data without re-encryption.
This complies with the policy of rotating keys annually without actively re-encrypting existing data.
2
Address the database credential security and rotation requirement.
Store the database credentials in AWS Secrets Manager and set up automatic 30-day rotation via an AWS Lambda function.
Secrets Manager securely stores secrets and supports seamless rotation for RDS/Aurora databases without causing downtime.

Key Concept

AWS KMS Automatic Key Rotation and AWS Secrets Manager Credential Rotation
Estimated Time:2m 0s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic