Examkin

Question

Difficulty: HardData Encryption and Key Management

A company stores compliance reports in an Amazon S3 bucket. The reports must be encrypted at rest using an AWS KMS Customer Managed Key (CMK). The company's security policy requires that the encryption key be rotated every year. In addition, historical reports encrypted with older versions of the key must remain readable without requiring manual re-encryption of the S3 objects, and the key management actions must be restricted to a specific security team. Which combination of actions will meet these security requirements? (Select TWO.)

  1. Enable automatic key rotation for the Customer Managed Key (CMK) in AWS KMS.Answer
  2. Configure the key policy of the Customer Managed Key (CMK) to grant administrative permissions to the security team's IAM role and cryptographic permissions to the application's IAM role.Answer
  3. C
    Perform manual rotation by creating a new Customer Managed Key (CMK) annually, and delete the older key to prevent unauthorized decryption of historical data.
  4. D
    Create a new Customer Managed Key (CMK) manually each year, and run an Amazon S3 Batch Operations job to re-encrypt all historical S3 objects using the new key version.
  5. E
    Store the database password and KMS key configuration as a plaintext String parameter in AWS Systems Manager Parameter Store to manage the application settings.

Answer

Enabling automatic key rotation for the Customer Managed Key (CMK) and configuring the key policy to grant administrative permissions to the security team while restricting cryptographic permissions to the application role.
Enabling automatic key rotation handles annual key rotation seamlessly because AWS KMS keeps previous backing key materials active to decrypt historical objects. Additionally, separating key administrative actions and cryptographic actions via key policies enforces separation of duties and least privilege.

Step-by-Step Solution

1
Evaluate key rotation mechanics.
Determine that automatic key rotation in AWS KMS generates new backing key material annually while retaining previous versions. This enables transparent decryption of historical S3 objects without manual re-encryption.
Meets the business requirement for annual key rotation while ensuring older data remains readable without manual intervention.
2
Enforce least privilege access control on the Customer Managed Key.
Configure a KMS key policy separating administrative privileges (given to the security team's role) from cryptographic privileges (given to the application's role).
Fulfills the security restriction that key management actions must be restricted to a specific security team.

Key Concept

AWS KMS key rotation behaviors and key policy design rules.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic