Examkin

Question

Difficulty: EasyData Encryption and Key Management

A company is developing a new application that stores customer data in an Amazon S3 bucket. The security policy requires that all data stored in the S3 bucket must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS) keys. Additionally, database credentials used by the application must be securely stored and automatically rotated every 30 days. Which TWO actions should a solutions architect take to meet these requirements?

  1. Configure the Amazon S3 bucket to use server-side encryption with AWS Key Management Service (SSE-KMS) using a customer managed key.Answer
  2. Store the database credentials in AWS Secrets Manager and configure a rotation schedule.Answer
  3. C
    Store the database credentials as a String parameter type in AWS Systems Manager Parameter Store.
  4. D
    Configure automatic key rotation on the customer managed key to immediately re-encrypt all existing historical objects in the S3 bucket.
  5. E
    Use the AWS account root user credentials to create the customer managed key and manage key policies.

Answer

Configure the Amazon S3 bucket to use server-side encryption with AWS Key Management Service (SSE-KMS) using a customer managed key, and store the database credentials in AWS Secrets Manager with a rotation schedule configured.
The correct solution involves configuring S3 server-side encryption using a customer managed key (SSE-KMS) to protect stored files, and using AWS Secrets Manager to store database credentials securely with automatic rotation configured. These actions meet the encryption and automated credentials management requirements following AWS best practices.

Step-by-Step Solution

1
Address S3 bucket encryption at rest.
Configure server-side encryption with AWS Key Management Service (SSE-KMS) on the S3 bucket using a customer managed key.
This satisfies the requirement to encrypt all stored data at rest using KMS keys while keeping control over the key policies.
2
Address database credential storage and rotation.
Store database credentials in AWS Secrets Manager and enable automatic rotation.
AWS Secrets Manager natively supports the secure storage of sensitive secrets and provides built-in rotation functionality for database credentials.

Key Concept

AWS KMS key management and secure secrets storage with automated rotation.
Estimated Time:1m 0s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic