Examkin

Soru

Zorluk: ZorData Protection and Encryption

A financial institution is deploying a payment gateway on AWS. The institution's compliance policy dictates that all customer transactions must be encrypted at rest using single-tenant cryptographic hardware under the institution's exclusive control. Additionally, all transactional data must be encrypted in transit across all application tiers.

Under the AWS Shared Responsibility Model, which of the following are responsibilities of the customer to meet these security requirements? (Select TWO.)

  1. Generating and managing the cryptographic keys and user accounts within an AWS CloudHSM instanceCevap
  2. B
    Securing the physical infrastructure and power supply of the host data centers housing the cryptographic hardware
  3. C
    Configuring AWS Key Management Service (AWS KMS) to provide dedicated, single-tenant hardware security modules (HSMs)
  4. Configuring SSL/TLS parameters to secure data in transit between application layersCevap
  5. E
    Managing the physical lifecycle and firmware updates of the hardware security modules (HSMs)

Cevap

Generating and managing the cryptographic keys and user accounts within an AWS CloudHSM instance, and configuring SSL/TLS parameters to secure data in transit between application layers.
Generating and managing keys inside AWS CloudHSM is a customer responsibility because CloudHSM provides dedicated cryptographic hardware where the customer has sole control over keys and users. Configuring SSL/TLS parameters for data in transit is also a customer responsibility because it is configured at the application and operating system level, which falls under customer control in the AWS Shared Responsibility Model.

Adım Adım Çözüm

1
Identify key management requirements.
The scenario requires dedicated, single-tenant cryptographic hardware under exclusive control. This points to AWS CloudHSM.
AWS CloudHSM provides dedicated, single-tenant hardware security modules where the customer manages the keys and users, unlike AWS KMS which is multi-tenant by default.
2
Identify data in transit requirements.
Securing data in transit requires SSL/TLS configuration between application layers.
Encrypting data in transit is handled by configuring secure communication protocols (like SSL/TLS) at the operating system or application tier, which are managed by the customer.
3
Differentiate customer responsibilities from AWS responsibilities.
AWS handles physical security, hardware lifecycle, and hypervisor security, while the customer handles data configuration, encryption settings, and key management inside their instances.
Under the Shared Responsibility Model, AWS is responsible for security 'of' the cloud (physical data centers, hardware infrastructure), and the customer is responsible for security 'in' the cloud (data encryption, network traffic protection).

Anahtar Kavram

Under the AWS Shared Responsibility Model, the customer is responsible for configuring encryption in transit (SSL/TLS) and managing their cryptographic keys and user accounts within single-tenant hardware like AWS CloudHSM, while AWS handles physical infrastructure and hardware maintenance.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Data Protection and Encryption

Bu konudan daha fazla soru