Examkin

Question

Difficulty: MediumData Encryption and Key Management

A solutions architect is migrating an on-premises application to AWS. The application requires access to a database password and a third-party partner's API token. These credentials must be encrypted at rest and rotated automatically every 60 days. Additionally, the application writes audit logs to an Amazon EBS volume, which must be encrypted using a customer managed KMS key that is rotated every year. The historical audit logs must remain readable after key rotation without manual intervention.

Which combination of actions should the solutions architect take to meet these security requirements? (Select TWO.)

  1. Store the database password and API token in AWS Secrets Manager, and configure a custom AWS Lambda function to rotate the secrets every 60 days.Answer
  2. Enable automatic key rotation for the customer managed KMS key used for the EBS volume.Answer
  3. C
    Store the database password and API token as String parameters in AWS Systems Manager Parameter Store, and write an Amazon EventBridge rule to update the plaintext values every 60 days.
  4. D
    Enable automatic key rotation for the customer managed KMS key, and schedule an AWS Lambda function to decrypt and re-encrypt all existing EBS volume snapshots with the new key version immediately after rotation.
  5. E
    Create a new customer managed KMS key annually, update the EBS volume configuration to use the new key, and delete the old KMS key to ensure only the active key is used.

Answer

The correct solutions are to store the credentials in AWS Secrets Manager with a custom Lambda function for rotation, and to enable automatic key rotation on the customer managed KMS key used for the EBS volume.
To secure credentials and meet the 60-day rotation requirement, AWS Secrets Manager should be used with a custom AWS Lambda function to rotate the database password and third-party API token. To secure the EBS volume and meet the annual rotation requirement without manual re-encryption or interrupting access to historical data, automatic key rotation should be enabled on the customer managed KMS key. AWS KMS automatically manages the rotation and retains the older key versions to decrypt existing data when needed.

Step-by-Step Solution

1
Analyze the credentials requirement.
The database password and API token must be encrypted and rotated every 60 days.
AWS Secrets Manager supports encrypting and rotating secrets. Since a third-party partner's API key is involved, a custom Lambda function is required to perform the rotation logic.
2
Analyze the storage encryption requirement.
The EBS volume must be encrypted using a customer managed KMS key that is rotated annually without manual key management or re-encryption.
Enabling automatic key rotation for the customer managed KMS key satisfies the annual rotation requirement. AWS KMS automatically retains the old key versions for decryption of older snapshots and volume blocks, removing the need for manual re-encryption.
3
Evaluate the distractors.
Identify insecure configurations (plaintext Parameter Store) and incorrect KMS rotation mechanics (unnecessary re-encryption or deletion of old keys).
Parameter Store String parameters do not encrypt data. Deleting retired KMS keys prevents decrypting existing logs. Re-encrypting historical data is an unnecessary operational overhead since KMS handles decryption of older data automatically.

Key Concept

Data Encryption and Key Management
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic