Examkin

Soru

Zorluk: KolayAWS KMS and Encryption

A developer needs to encrypt a large data file locally on an application server before uploading it to Amazon S3. The developer wants to use client-side envelope encryption with an AWS KMS customer managed key. Which of the following steps must the developer perform to complete this encryption process? (Select TWO.)

  1. Call the AWS KMS GenerateDataKey API operation to receive a plaintext data key and an encrypted ciphertext data key.Cevap
  2. Encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.Cevap
  3. C
    Call the AWS KMS Encrypt API operation to encrypt the entire data file directly using the customer managed key.
  4. D
    Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation to obtain the plaintext data key for local encryption.
  5. E
    Save the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to use for decryption.

Cevap

To encrypt the file using envelope encryption, the developer must call the GenerateDataKey API to obtain the plaintext and ciphertext data keys, encrypt the data locally with the plaintext key, and then delete the plaintext key from memory.
The correct options describe the client-side envelope encryption workflow: calling the GenerateDataKey API to get both the plaintext and ciphertext keys, using the plaintext key to encrypt the file locally, and subsequently discarding the plaintext key from memory.

Adım Adım Çözüm

1
Generate data keys using AWS KMS
The application receives a plaintext data key and a ciphertext data key from the GenerateDataKey API call.
The plaintext key is needed to perform the encryption algorithm locally, and the ciphertext key is needed to store with the data for future decryption.
2
Encrypt the file locally
The file is encrypted using the plaintext data key.
Envelope encryption uses a unique symmetric data key locally to secure the file content.
3
Clean up memory and prepare storage
The plaintext key is deleted from the application's memory, and the encrypted file is paired with the ciphertext data key.
Removing the plaintext key from memory minimizes the risk of exposure. The ciphertext data key can be safely stored alongside the encrypted file in S3.

Anahtar Kavram

Envelope encryption is the practice of encrypting data with a data key, and then encrypting the data key under another key.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru