Examkin

Question

Difficulty: HardData Encryption and Key Management

A company stores compliance logs in an Amazon S3 bucket. The logs are encrypted at rest using an AWS KMS Customer Managed Key. The company's security policy dictates that when the KMS key is rotated, all existing historical logs must be immediately re-encrypted under the new key version. Additionally, the log ingestion application requires database credentials that must be rotated every 3030 days. Which combination of steps will meet these security requirements in the most secure manner?

  1. A
    Perform manual key rotation by creating a new customer managed key and updating the S3 bucket configuration. Delete the old customer managed key to ensure no historical logs can be read using the old key material. Store the database credentials in Systems Manager Parameter Store as a SecureString parameter and configure it to rotate every 3030 days using an AWS Lambda function.
  2. B
    Enable automatic key rotation for the customer managed key, which automatically schedules a background job to re-encrypt all historical S3 objects with the new key version. Store the database credentials in Systems Manager Parameter Store as a String parameter and write a custom script to rotate the parameter value every 3030 days.
  3. Enable automatic key rotation for the customer managed key. Run an Amazon S3 Batch Operations copy job to copy the S3 objects to themselves using the same key to re-encrypt historical data. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 3030 days.Answer
  4. D
    Log in as the AWS account root user to manually force rotation of the AWS managed key (aws/s3). Use the AWS CLI to run a script that downloads, decrypts, and re-uploads all historical objects. Store the database credentials as a plaintext parameter in Systems Manager Parameter Store with a lifecycle policy.

Answer

Enable automatic key rotation for the customer managed key. Run an Amazon S3 Batch Operations copy job to copy the S3 objects to themselves using the same key to re-encrypt historical data. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 3030 days.
The correct option correctly configures automatic rotation for the customer managed key, which creates a new key version annually while maintaining historical versions for decryption. To immediately re-encrypt existing objects under the new key version, an S3 Batch Operations copy job copies objects to themselves, applying the active new key material. Finally, it uses AWS Secrets Manager, which natively and securely manages database credential storage and automatic rotation.

Step-by-Step Solution

1
Enable KMS Key Rotation
Automatic rotation is enabled, meaning AWS KMS will generate a new key version annually for new encryption operations while keeping the old key version active for decrypting existing data.
This complies with security policies requiring rotated keys for new data without manually updating application settings or key ARNs.
2
Re-encrypt Historical Data
Run an Amazon S3 Batch Operations copy job that copies S3 objects to themselves using the existing KMS key alias.
Because AWS S3 copy operations write objects as new writes, they are encrypted using the currently active version of the KMS key, satisfying the requirement to immediately re-encrypt historical data under the new key version.
3
Configure Secure Credentials Storage and Rotation
Deploy AWS Secrets Manager to hold the database credentials and configure a rotation schedule of 3030 days.
AWS Secrets Manager natively integrates with database credentials to orchestrate rotation via Lambda and secures secrets at rest, unlike plaintext parameter configurations.

Key Concept

AWS KMS key rotation behavior combined with S3 Batch Operations copy actions for historical data re-encryption, and native secret management via AWS Secrets Manager.
Estimated Time:2m 30s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic