Examkin

Soru

Zorluk: ZorAWS KMS and Encryption

A developer is building a document processing application that must secure sensitive PDF documents before uploading them to a third-party storage service. The average size of each document is 15 MB15\text{ MB}. To meet security requirements, the developer must encrypt the documents client-side using an AWS KMS Customer Managed Key (CMK) while minimizing latency and network overhead. Which approach should the developer implement to encrypt these documents securely and efficiently?

  1. A
    Call the KMS Encrypt API directly, passing the raw document binary as the plaintext parameter along with the CMK ARN, and store the returned ciphertext.
  2. Call the KMS GenerateDataKey API with the CMK to obtain a plaintext data key and an encrypted data key. Encrypt the document locally using the plaintext data key, delete the plaintext key from memory, and store the encrypted data key alongside the encrypted document.Cevap
  3. C
    Call the KMS GenerateDataKeyWithoutPlaintext API to retrieve an encrypted data key. Send the encrypted data key to the KMS Decrypt API to get the plaintext key, encrypt the document locally, and store the encrypted data key with the document.
  4. D
    Retrieve a pre-generated symmetric key stored in AWS Systems Manager Parameter Store as a SecureString parameter using the GetParameter API. Encrypt the document locally with this key and discard the retrieved parameter value.

Cevap

Call the KMS GenerateDataKey API with the CMK to obtain a plaintext data key and an encrypted data key. Encrypt the document locally using the plaintext data key, delete the plaintext key from memory, and store the encrypted data key alongside the encrypted document.
The correct approach is to call the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the document locally, and is then discarded from memory. The encrypted data key is stored alongside the encrypted document so that it can be decrypted later using the Decrypt API. This utilizes envelope encryption, which is necessary because the documents exceed the size limit of the direct KMS Encrypt API.

Adım Adım Çözüm

1
Evaluate the file size (15 MB15\text{ MB}) against AWS KMS direct encryption payload limits.
Since the direct KMS Encrypt API has a strict limit of 4 KB4\text{ KB}, direct encryption is not possible. Envelope encryption must be used.
To select the appropriate KMS workflow based on payload size constraints.
2
Determine the most efficient API call for obtaining data keys for client-side envelope encryption.
GenerateDataKey returns both the plaintext key (for local encryption) and the encrypted key (for storage) in a single network request.
To minimize latency and network calls during document upload processing.
3
Validate security best practices for handling the generated plaintext data key.
Once the document is encrypted locally with the plaintext key, the plaintext key is deleted from application memory, and the encrypted key is packaged with the ciphertext.
To ensure the plaintext key is not exposed or leaked.

Anahtar Kavram

Client-side envelope encryption workflow using AWS KMS GenerateDataKey API
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru