Examkin

Soru

Zorluk: OrtaData Protection and Encryption

A media streaming company is storing user account information in Amazon S3 and database backups in Amazon RDS. The company's compliance policy requires all of this data to be encrypted at rest. According to the AWS Shared Responsibility Model, which of the following is a customer responsibility in this scenario?

  1. A
    Ensuring the physical destruction of retired storage media that contained the backups
  2. B
    Managing the physical security of the hardware security modules that protect the keys
  3. Configuring server-side encryption and managing access policies for the cryptographic keysCevap
  4. D
    Applying security patches to the physical hypervisors running the key management services

Cevap

Configuring server-side encryption and managing access policies for the cryptographic keys
Under the AWS Shared Responsibility Model, the customer is responsible for data encryption configurations (security in the cloud), which includes enabling server-side encryption on services like Amazon S3 and Amazon RDS and specifying who has permissions to use the encryption keys.

Adım Adım Çözüm

1
Identify that the requirement is for encrypting data at rest (stored in Amazon S3 and Amazon RDS).
Recognized that this falls under data protection and key management.
Encryption of data at rest involves both selecting the encryption mechanism and managing the access controls to the keys used for encryption.
2
Apply the AWS Shared Responsibility Model, dividing tasks into customer responsibility (security in the cloud) and AWS responsibility (security of the cloud).
Differentiated infrastructure management from resource configuration.
AWS manages physical data centers, hardware security, hypervisors, and storage sanitization, while customers configure resources, access permissions, and choose whether/how to enable encryption.
3
Select the option that represents a customer-managed action.
Identified that enabling server-side encryption and managing key access policies is the customer's duty.
Only configuring the encryption settings and controlling access policies is under the customer's direct control within the AWS Management Console or APIs.

Anahtar Kavram

Data protection at rest and the Shared Responsibility Model
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Data Protection and Encryption

Bu konudan daha fazla soru