Examkin

Soru

Zorluk: KolayAWS KMS and Encryption

A developer is writing a backend application hosted on AWS Lambda that needs to decrypt a sensitive database connection string. The connection string was previously encrypted directly using an AWS KMS customer managed key (CMK). The Lambda function's IAM execution role has been granted permissions to use the key. Which AWS KMS API action must the developer invoke within the application code to retrieve the plaintext connection string?

  1. DecryptCevap
  2. B
    GenerateDataKey
  3. C
    GetSecretValue
  4. D
    ReEncrypt

Cevap

Decrypt
The Decrypt API operation is the correct action to call because it decrypts ciphertext that was encrypted directly using an AWS KMS key, returning the decrypted plaintext to the application.

Adım Adım Çözüm

1
Identify the source of encryption and the desired output.
The database connection string was encrypted directly using an AWS KMS customer managed key, and the application needs to retrieve the plaintext string.
This establishes that we are dealing with direct decryption of KMS ciphertext rather than local envelope encryption or retrieving a secret from a secret store.
2
Select the correct AWS KMS API operation for direct decryption.
The Decrypt operation is selected.
The Decrypt API operation takes ciphertext encrypted under a KMS key and returns the decrypted plaintext, which matches the application's requirement.

Anahtar Kavram

Direct decryption using AWS KMS API
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru