Examkin

Question

Difficulty: MediumData Encryption and Key Management

An enterprise architecture team is reviewing the security posture of an analytics application that processes sensitive financial data. The application requires access to a database password, and all associated Amazon EBS volumes must be encrypted. To comply with internal security policies, the database password must be rotated every 30 days without manual intervention, and the KMS keys used for EBS volume encryption must be automatically rotated annually. Which strategy should a solutions architect implement to meet these requirements with the least operational effort?

  1. Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.Answer
  2. B
    Store the database password in AWS Systems Manager Parameter Store as a standard String parameter. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.
  3. C
    Store the database password in AWS Secrets Manager with automatic rotation enabled. Encrypt the EBS volumes using a Customer Managed Key (CMK), enable automatic key rotation, and configure an automated script to immediately re-encrypt all existing historical EBS volume data block-by-block under the new key version.
  4. D
    Store the database password in AWS Secrets Manager. Log in as the AWS account root user to configure the Secrets Manager rotation policy and to create the Customer Managed Key (CMK) for EBS encryption to bypass KMS key policy permissions.

Answer

Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function. Encrypt the EBS volumes using a Customer Managed Key (CMK) and enable automatic key rotation in AWS KMS.
The correct solution stores database passwords securely in AWS Secrets Manager, which natively orchestrates rotation using AWS Lambda. It also encrypts EBS volumes using a Customer Managed Key (CMK) and leverages AWS KMS's native automatic rotation feature. This ensures that new data is encrypted with the new key version, while the previous key versions are retained to decrypt existing data without manual re-encryption overhead.

Step-by-Step Solution

1
Identify the secure storage and rotation mechanism for database credentials.
AWS Secrets Manager is selected because it natively supports automated rotation of database credentials using AWS Lambda, unlike Systems Manager Parameter Store standard String parameters.
Securing database credentials requires encryption at rest and automated lifecycle management.
2
Identify the encryption and rotation mechanism for EBS volumes.
Use a Customer Managed Key (CMK) with automatic annual key rotation enabled.
AWS KMS supports automatic annual rotation for CMKs without requiring existing data to be re-encrypted.
3
Combine the components into a single architecture that minimizes operational overhead and adheres to best practices.
The database credentials are managed by Secrets Manager and the EBS volumes are encrypted using KMS CMKs with rotation enabled, without root account usage or manual re-encryption scripts.
This combination meets all compliance requirements with native AWS capabilities.

Key Concept

Database credential rotation using Secrets Manager and KMS Customer Managed Key automatic rotation mechanics.
Estimated Time:1m 30s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic