Examkin

Soru

Zorluk: OrtaData Protection and Encryption

A healthcare enterprise needs to store sensitive patient files on Amazon S3. To meet compliance regulations, they require encryption at rest using dedicated, single-tenant cryptographic hardware where they maintain full control over the administration of the hardware security modules (HSMs). Which AWS service or feature should the enterprise configure to manage their encryption keys?

  1. A
    AWS Key Management Service (AWS KMS)
  2. AWS CloudHSMCevap
  3. C
    Amazon S3 Managed Keys (SSE-S3)
  4. D
    AWS Artifact

Cevap

AWS CloudHSM
AWS CloudHSM is the correct choice because it provides dedicated, single-tenant hardware security module (HSM) instances within the customer's VPC. This gives the customer exclusive administrative control over the keys and cryptographic operations, satisfying the strict compliance constraint.

Adım Adım Çözüm

1
Analyze the customer requirements for encryption at rest.
The customer needs dedicated, single-tenant cryptographic hardware (HSMs) and full administrative control over the keys.
This determines whether a multi-tenant managed service (like AWS KMS) or a dedicated single-tenant solution (like AWS CloudHSM) is required.
2
Compare AWS encryption and key management services against the requirements.
AWS CloudHSM satisfies the single-tenant dedicated hardware requirement, whereas AWS KMS uses shared multi-tenant HSMs. SSE-S3 is fully managed by AWS on shared storage, and AWS Artifact is only for compliance documents.
Selecting the service that matches the dedicated, single-tenant hardware and customer control criteria leads to the correct answer.

Anahtar Kavram

Dedicated single-tenant hardware security modules (CloudHSM) versus managed multi-tenant key management (KMS).
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Data Protection and Encryption

Bu konudan daha fazla soru