Examkin

Question

Difficulty: EasyData Encryption and Key Management

A solutions architect is configuring encryption for an Amazon Elastic Block Store (Amazon EBS) volume containing sensitive database backups. The company's security policy requires that the KMS key used for encryption be rotated automatically every year. Which solution meets this requirement with the minimum administrative effort?

  1. A
    Create a new customer managed key in AWS Key Management Service (AWS KMS) every year, delete the old key, and run a script to decrypt and re-encrypt the active EBS volume.
  2. B
    Store the encryption key in AWS Systems Manager Parameter Store as a plain String parameter and write an automated script to rotate it annually.
  3. Create a customer managed key in AWS Key Management Service (AWS KMS) and enable automatic key rotation.Answer
  4. D
    Enable automatic key rotation on the KMS key and write an AWS Lambda function to re-encrypt all existing data on the EBS volume using the new key version.

Answer

Create a customer managed key in AWS Key Management Service (AWS KMS) and enable automatic key rotation.
The correct option is correct because enabling automatic key rotation on a customer managed key in AWS Key Management Service (AWS KMS) automatically rotates the backing key once per year. The key ID remains the same, and older backing keys are preserved by AWS KMS to decrypt existing data without requiring manual re-encryption or administrative intervention.

Step-by-Step Solution

1
Evaluate the security requirement of automatically rotating encryption keys annually.
Identify that AWS Key Management Service (AWS KMS) provides built-in automatic key rotation capabilities.
AWS KMS is the native service for managing encryption keys used by Amazon EBS.
2
Compare manual key rotation against automatic key rotation for customer managed keys.
Automatic rotation of customer managed keys requires only a single configuration toggle and handles historical data decryption automatically.
This minimizes the administrative overhead requested by the scenario.

Key Concept

AWS KMS Automatic Key Rotation
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic