Examkin

Soru

Zorluk: OrtaData Encryption and Key Management

A financial services company stores daily transaction reports in an Amazon S3 bucket. The company's security policy requires that all reports be encrypted at rest using AWS KMS Customer Managed Keys (CMKs) with automatic annual rotation enabled. The operations team is concerned that rotating the key will render historical reports encrypted under the previous key version unreadable. Which of the following describes the behavior of AWS KMS key rotation in this scenario?

  1. A
    AWS KMS automatically initiates a background job to re-encrypt all historical reports in the S3 bucket using the new backing key version.
  2. B
    The operations team must manually update the application code to specify the new key version ID when retrieving reports created after the rotation date.
  3. AWS KMS automatically retains older versions of the backing key, allowing historical reports to be decrypted seamlessly without any manual configuration.Cevap
  4. D
    The operations team must store the key rotation metadata as a plaintext parameter in AWS Systems Manager Parameter Store to track which key version decrypts each report.

Cevap

AWS KMS automatically retains older versions of the backing key, allowing historical reports to be decrypted seamlessly without any manual configuration.
The correct answer states that AWS KMS automatically retains older versions of the backing key. When automatic key rotation is enabled, AWS KMS generates a new backing key for encryption operations but keeps previous versions of the backing key active so that ciphertexts encrypted with them can still be decrypted. The decryption process remains completely seamless and requires no manual key selection, rotation tracking, or code changes.

Adım Adım Çözüm

1
Analyze how AWS KMS handles automatic key rotation for Customer Managed Keys (CMKs).
Confirm that automatic rotation generates a new backing key version for encryption, while preserving older versions of the backing key.
Allows older ciphertexts to remain decryptable using the corresponding key version under which they were originally encrypted.
2
Evaluate the decryption process for historical files after key rotation.
Identify that the metadata embedded within the ciphertext allows AWS KMS to automatically select the correct backing key version for decryption.
Eliminates the need for manual tracking, database mappings, or code changes in application decryption calls.
3
Cross-reference against security best practices and alternative systems.
Verify that re-encryption is not triggered automatically (which would be resource-intensive and unnecessary) and that storing metadata in plaintext in Parameter Store is a security anti-pattern.
Ensures the selected architecture adheres to least privilege and native AWS service mechanics.

Anahtar Kavram

AWS KMS Automatic Key Rotation and Backing Key Management
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru