Examkin

Question

Difficulty: MediumData Encryption and Key Management

A retail company stores sensitive customer profile data in an Amazon DynamoDB table. The security team requires that the data be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS to allow full audit logging of key usage. The company also requires that the encryption key be rotated automatically every year, and they must ensure that DynamoDB can continue to read and write existing and new data seamlessly after key rotation without any manual re-encryption or table configuration changes. How should the solutions architect configure this to meet these requirements?

  1. A
    Configure the DynamoDB table to use the default AWS owned key. To meet the audit logging requirement, store the sensitive database attributes as plaintext parameters in AWS Systems Manager Parameter Store and reference them in the application.
  2. Configure the DynamoDB table to use a Customer Managed Key for encryption. Enable automatic annual rotation on the Customer Managed Key in AWS KMS.Answer
  3. C
    Configure the DynamoDB table to use a Customer Managed Key. Enable automatic annual key rotation, and schedule a monthly AWS Batch job to read all DynamoDB items and write them back to force immediate re-encryption of all historical records under the new key version.
  4. D
    Manually create a new Customer Managed Key in AWS KMS each year. Update the DynamoDB table encryption settings to use the new key identifier, then execute an AWS Lambda function to scan the table and update every item to ensure it is encrypted with the new key version.

Answer

Configure the DynamoDB table to use a Customer Managed Key for encryption, and enable automatic annual rotation on the Customer Managed Key in AWS KMS.
Configuring the DynamoDB table with a Customer Managed Key (CMK) ensures that all key usage is logged in AWS CloudTrail, satisfying the audit logging requirement. Enabling automatic annual key rotation on the CMK allows AWS KMS to generate new key material every year while keeping the same key ID. KMS automatically retains older key versions to decrypt historical data and uses the new key version to encrypt new writes, providing seamless access without any application downtime, table configuration changes, or manual re-encryption.

Step-by-Step Solution

1
Enable AWS KMS Customer Managed Key encryption for the Amazon DynamoDB table to generate detailed key usage logs in AWS CloudTrail.
The table encryption is managed by a customer controlled key, satisfying the audit logging requirement.
AWS owned keys do not write key usage events to CloudTrail, whereas Customer Managed Keys do.
2
Enable automatic key rotation for the Customer Managed Key in AWS KMS.
The key material is automatically rotated annually while retaining the same Key ID.
This satisfies the requirement for annual rotation without modifying table configurations or application code.
3
Allow AWS KMS to manage historical key versions for decryption.
Existing items can be decrypted seamlessly, and new items are encrypted using the rotated key material.
AWS KMS automatically retains previous versions of key material to decrypt existing data, removing the need for manual re-encryption.

Key Concept

KMS Key Rotation Mechanics and Customer Managed Keys
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic