Examkin

Soru

Zorluk: KolayAWS KMS and Encryption

A developer is writing a local utility to back up database exports to Amazon S3. The compliance policy requires the developer to use client-side envelope encryption with an AWS KMS customer managed key to secure the files before they are uploaded. Which of the following actions must the developer perform to encrypt the files locally using client-side envelope encryption? (Select TWO.)

  1. Call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key.Cevap
  2. Encrypt the database exports locally using the plaintext data key, and then securely discard the plaintext data key from memory.Cevap
  3. C
    Send the database export files directly to the AWS KMS Encrypt API operation to perform the encryption.
  4. D
    Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation to obtain the plaintext key needed to encrypt the files.
  5. E
    Retrieve a plaintext data key dynamically from the AWS Systems Manager Parameter Store as a SecureString parameter to encrypt the local files.

Cevap

The developer must call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key, encrypt the database exports locally using the plaintext data key, and then securely discard the plaintext key from memory.
In client-side envelope encryption, the developer must first call the GenerateDataKey API operation using an AWS KMS customer managed key (CMK). This operation returns both a plaintext data key (used to encrypt the file locally) and an encrypted copy of the data key (stored alongside the encrypted data). Once the files are encrypted locally, the plaintext data key must be securely deleted from memory to maintain security.

Adım Adım Çözüm

1
Request a data key from AWS KMS.
The GenerateDataKey API operation returns a plaintext data key and an encrypted version of that key.
This starts the client-side envelope encryption process by providing the key material required for local encryption.
2
Encrypt the files locally.
The local database exports are encrypted using the plaintext data key.
This performs the actual cryptographic operation on the client side, keeping the data secure before transport.
3
Clean up the plaintext key material.
The plaintext data key is discarded from memory.
To prevent unauthorized access to the encryption key, the plaintext key must not be persisted or left in memory.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru