Examkin

Soru

Zorluk: KolayAWS KMS and Encryption

A developer is designing a client-side encryption solution for a custom application. The application will use envelope encryption to secure data packets before storing them. The developer calls the AWS KMS `GenerateDataKey` API operation.

Which components does AWS KMS return to the application in the API response?

  1. A
    The plaintext data key and the encrypted data payload
  2. A plaintext data key and a ciphertext data keyCevap
  3. C
    A ciphertext data key and the encrypted data payload
  4. D
    A plaintext data key and a Systems Manager parameter reference

Cevap

A plaintext data key and a ciphertext data key
The correct option is the one stating that a plaintext data key and a ciphertext data key are returned. The `GenerateDataKey` operation is designed to support client-side envelope encryption by providing a plaintext key for immediate encryption by the client application, and a ciphertext key that can be safely stored alongside the encrypted data.

Adım Adım Çözüm

1
Analyze the request to use envelope encryption via the `GenerateDataKey` API operation.
The application needs to encrypt data locally, which requires a data key generated by AWS KMS.
Envelope encryption relies on a data key generated by a root key (KMS Customer Managed Key) to encrypt the actual data.
2
Identify the outputs returned by the `GenerateDataKey` operation.
AWS KMS returns two parts: a plaintext data key for immediate encryption, and a ciphertext data key for storage.
The plaintext key is used to encrypt the data locally and then deleted from memory. The ciphertext key is stored with the encrypted data so it can be decrypted later by calling the KMS Decrypt API.

Anahtar Kavram

AWS KMS Envelope Encryption and the GenerateDataKey API
Tahmini Süre:45s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru