Examkin

Soru

Zorluk: KolayAWS KMS and Encryption

A developer needs to encrypt a 5 GB file on an application server using AWS KMS client-side envelope encryption. Which AWS KMS API action should the developer call to obtain both the plaintext data key for local encryption and the encrypted copy of the data key for storage?

  1. A
    Encrypt
  2. GenerateDataKeyCevap
  3. C
    GenerateDataKeyWithoutPlaintext
  4. D
    GetSecretValue

Cevap

GenerateDataKey
The correct action is GenerateDataKey because it returns a plaintext data key for immediate local encryption and an encrypted version of the data key that can be safely stored alongside the encrypted file.

Adım Adım Çözüm

1
Identify the size of the dataset and the encryption model.
The file size is 5 GB, which exceeds the 4 KB direct encryption limit of AWS KMS, requiring client-side envelope encryption.
Large files must be encrypted locally using a data key to avoid network overhead and KMS API payload size limits.
2
Determine the API call that provides the required keys for envelope encryption.
The developer needs a plaintext data key to perform the local encryption and an encrypted data key to save with the ciphertext.
Envelope encryption relies on having both the plaintext key to encrypt the payload and the encrypted key to bundle with the data for future decryption.
3
Select the correct KMS API action that returns both keys in a single request.
The GenerateDataKey API action returns both the plaintext data key and the encrypted ciphertext data key.
This single API call satisfies the security workflow without requiring subsequent decryption or extra round trips.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Tahmini Süre:45s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru