Examkin

Soru

Zorluk: OrtaAWS KMS and Encryption

A developer is building an application that needs to encrypt files locally before uploading them to Amazon S3. Each file is approximately 150 MB150\text{ MB} in size. The encryption process must use client-side envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS, minimizing network overhead and API requests. Which two actions must the developer perform to complete this client-side encryption process?

  1. Call the KMS GenerateDataKey API passing the Customer Managed Key ID to retrieve a plaintext data key and a ciphertext data key.Cevap
  2. Encrypt the file locally using the plaintext data key, store the ciphertext data key alongside the encrypted file in Amazon S3, and delete the plaintext data key from memory.Cevap
  3. C
    Call the KMS Encrypt API directly with the file payload to encrypt the entire file before transmitting it.
  4. D
    Call the KMS GenerateDataKeyWithoutPlaintext API and use the returned ciphertext data key to encrypt the files locally.
  5. E
    Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString, and retrieve it for each file upload.

Cevap

To perform client-side envelope encryption, the developer must call the KMS GenerateDataKey API to obtain a plaintext and ciphertext data key, use the plaintext data key to encrypt the file locally, store the ciphertext data key alongside the encrypted file, and destroy the plaintext data key from memory.
The correct options describe the standard client-side envelope encryption workflow. The developer calls the GenerateDataKey API to obtain both a plaintext data key and a ciphertext data key. The plaintext key is used to encrypt the 150 MB150\text{ MB} file locally, after which the plaintext key is discarded from memory. The ciphertext data key is stored alongside the encrypted file in S3 so that it can be decrypted later by calling the KMS Decrypt API.

Adım Adım Çözüm

1
Generate a unique data key using AWS KMS.
The application receives a plaintext data key and a ciphertext data key encrypted by the KMS Customer Managed Key.
This is the initial step of the envelope encryption pattern, allowing the local system to obtain the keying material needed for bulk encryption without sending the actual file payload to KMS.
2
Encrypt the file locally using the plaintext data key.
The 150 MB150\text{ MB} file is converted into ciphertext.
This allows the high-throughput encryption of large payloads to occur locally, avoiding KMS size limitations (such as the 4 KB4\text{ KB} limit on the Encrypt API) and reducing network overhead.
3
Upload the encrypted file and the ciphertext data key to Amazon S3, and clean up memory.
The encrypted payload and ciphertext key are stored in S3, and the plaintext data key is purged from application memory.
Ensures that the plaintext key is not exposed or stored persistently, while the ciphertext key remains available for future decryption operations.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow for Large Payloads
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru