Examkin

Question

Difficulty: Very hardData Encryption and Key Management

A medical device company is designing a multi-Region, multi-account architecture to store and protect patient telemetry data. The raw data is stored in Amazon S3 buckets in Account A (ingestion account) located in the `us-east-1` Region and encrypted using an AWS Key Management Service (AWS KMS) customer managed key (K1K_1). To comply with regulatory requirements, the data must be replicated to Account B (compliance archive account) in the `us-west-2` Region. The replicated data must be encrypted at rest using a customer managed key (K2K_2) owned by Account B. The database credentials for accessing the data warehouse must be rotated every 1515 days automatically, and no plaintext sensitive configuration parameters should be stored in source code or plain parameter fields. Additionally, the security team requires that the encryption keys (K1K_1 and K2K_2) are rotated annually, but they are concerned about whether historical backups will remain readable after rotation. Which two actions should a solutions architect recommend to implement these security requirements? (Select TWO.)

  1. Enable automatic key rotation for the customer managed keys in AWS KMS, as KMS automatically retains historical backing key material to decrypt data encrypted under previous versions.Answer
  2. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 15 days using a custom AWS Lambda function, referencing the secret Amazon Resource Name (ARN) in the application configuration.Answer
  3. C
    Enable automatic key rotation in AWS KMS, and schedule an Amazon S3 Batch Operations job to re-encrypt all historical data in Account B with the new key material immediately after rotation.
  4. D
    Store the database credentials as standard String parameters in AWS Systems Manager Parameter Store to minimize costs, and configure an Amazon EventBridge rule to execute an API call that rotates the parameter value every 15 days.
  5. E
    Configure manual key rotation by creating new KMS keys annually, update the application to use the new key ARNs, and delete the old KMS keys to avoid key storage fees.

Answer

Enable automatic key rotation for the customer managed keys in AWS KMS, as KMS automatically retains historical backing key material to decrypt data encrypted under previous versions; and store the database credentials in AWS Secrets Manager and configure automatic rotation every 15 days using a custom AWS Lambda function, referencing the secret Amazon Resource Name (ARN) in the application configuration.
The correct options recommend enabling automatic key rotation for the customer managed keys in AWS KMS and using AWS Secrets Manager for credential storage and rotation. Automatic key rotation ensures that KMS keeps old backing keys to decrypt older data, meaning that historical backups remain readable without any re-encryption tasks. Storing credentials in AWS Secrets Manager allows automatic rotation every 15 days using a custom Lambda function, while referencing the credentials via their ARN avoids exposing them in plaintext.

Step-by-Step Solution

1
Evaluate the database credential management requirements.
Determine that Secrets Manager is the optimal service because it natively supports automatic rotation of credentials (via AWS Lambda) every 15 days and integrates with VPCs and IAM policies for secure, non-plaintext referencing.
This satisfies the constraint that database credentials must be rotated automatically and cannot be stored in plaintext parameter fields or source code.
2
Analyze KMS key rotation behavior for compliance and disaster recovery.
Confirm that when automatic key rotation is enabled for Customer Managed Keys, KMS handles the creation of new backing keys while keeping old ones intact.
This guarantees that older ciphertexts (historical backups/replicated data) can still be decrypted by KMS automatically without manual overhead or data re-encryption.
3
Assess the risk of manual key rotation and deletion.
Recognize that deleting old keys renders any historical data encrypted under those keys permanently unrecoverable, making manual rotation with deletion highly dangerous.
This rules out solutions that suggest deleting the old keys or manual management schemes that introduce operational overhead and risk data loss.

Key Concept

AWS KMS key rotation maintains older key versions to allow decryption of historical ciphertexts, while AWS Secrets Manager provides secure, automated credential rotation without exposing plaintext variables.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic