Examkin

Soru

Zorluk: KolayAWS KMS and Encryption

A developer is writing a script to encrypt a small configuration string of size 500 B500\text{ B} before storing it in a database. The developer wants to use AWS KMS to perform the encryption directly on the AWS side, avoiding the complexity of local envelope encryption. Which AWS KMS API operation should the developer call to encrypt this data?

  1. EncryptCevap
  2. B
    GenerateDataKey
  3. C
    ReEncrypt
  4. D
    GetSecretValue

Cevap

The Encrypt operation should be called because it directly encrypts small payloads (up to 4 KB4\text{ KB}) using the KMS key on the AWS side.
The correct answer is the direct encryption operation because the payload is small (500 B500\text{ B}), which is below the 4 KB4\text{ KB} limit for direct KMS encryption, allowing the developer to encrypt it without the overhead of client-side envelope encryption.

Adım Adım Çözüm

1
Determine the size of the payload to be encrypted.
The payload size is 500 B500\text{ B}, which is well under the maximum limit of 4 KB4\text{ KB} for direct KMS encryption.
AWS KMS direct encryption via the Encrypt API has a payload limit of 4 KB4\text{ KB}.
2
Identify the encryption approach requested.
Direct encryption on the AWS KMS side is required, avoiding local client-side envelope encryption.
Direct encryption means we do not need to generate a data key locally; we send the plaintext directly to KMS.
3
Select the API operation that matches these criteria.
The Encrypt API operation matches both the size limitation and the requirement for direct KMS-side encryption.
Calling Encrypt returns the encrypted ciphertext directly from AWS KMS.

Anahtar Kavram

Direct encryption using AWS KMS is limited to payloads of up to 4 KB4\text{ KB}, whereas larger payloads require client-side envelope encryption using generated data keys.
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru