Examkin

Question

Difficulty: EasyData Encryption and Key Management

A startup is deploying a new application that integrates with a third-party payment provider. The application needs to retrieve a payment gateway API key. The startup's security policy requires the API key to be encrypted at rest, and all decryption events must be audited. Which solution meets these requirements securely?

  1. Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, using a Customer Managed Key in AWS Key Management Service (AWS KMS).Answer
  2. B
    Store the API key as a plain text String parameter in AWS Systems Manager Parameter Store, and restrict access using IAM policies.
  3. C
    Store the API key on the application's root EBS volume, using the AWS account root user credentials to encrypt the volume.
  4. D
    Store the API key in an Amazon S3 bucket using default encryption with a KMS Customer Managed Key, and rely on automatic key rotation to immediately re-encrypt the stored files.

Answer

Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, using a Customer Managed Key in AWS Key Management Service (AWS KMS).
Storing the API key as a SecureString parameter in AWS Systems Manager Parameter Store ensures that the data is encrypted at rest using AWS KMS. In addition, AWS KMS logs all decryption requests to AWS CloudTrail, satisfying the auditing requirement.

Step-by-Step Solution

1
Determine the storage service that supports encryption of sensitive variables.
AWS Systems Manager Parameter Store with the SecureString parameter type is selected because it integrates with AWS KMS for encryption.
This meets the requirement of encrypting the sensitive API key at rest.
2
Configure encryption with a Customer Managed Key (CMK) in AWS KMS.
The API key is encrypted using the CMK, and access permissions are managed via key policies and IAM.
Using a CMK allows fine-grained access control and key rotation management.
3
Verify that auditing requirements are met.
AWS KMS logs all key usage, including Decrypt API calls, to AWS CloudTrail.
This provides a complete audit trail of when and by whom the API key was decrypted.

Key Concept

Storing sensitive information securely using Systems Manager Parameter Store SecureString parameters and KMS encryption with auditing.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic