Examkin

Soru

Zorluk: OrtaData Encryption and Key Management

A solutions architect is designing a secure architecture for a financial application. The application's database runs on Amazon EC2 instances with Amazon EBS volumes, and it accesses an external API using an API key. The company's security policy mandates that:

1. All EBS volumes must be encrypted at rest, and the encryption keys must rotate annually without requiring manual data re-encryption or causing downtime.
2. The external API key must be stored securely, rotate automatically every 30 days, and not be exposed in plaintext in any configuration files.

Which combination of actions should the solutions architect take to meet these security requirements? (Select TWO.)

  1. Create an AWS KMS customer managed key to encrypt the EBS volumes, and enable automatic key rotation to rotate the key material annually without re-encrypting existing data.Cevap
  2. Store the external API key in AWS Secrets Manager and configure automatic rotation every 30 days using an AWS Lambda function.Cevap
  3. C
    Create an AWS KMS customer managed key for the EBS volumes, and configure a policy to force immediate re-encryption of all historical EBS snapshots under the new key version when rotation occurs.
  4. D
    Store the external API key as a standard plaintext String parameter in AWS Systems Manager Parameter Store to simplify rotation scripting.
  5. E
    Manually generate a new AWS KMS customer managed key annually, delete the old key, and use a script to re-encrypt all active EBS volumes with the new key.

Cevap

Create an AWS KMS customer managed key to encrypt the EBS volumes and enable automatic rotation, and store the API key in AWS Secrets Manager with automatic rotation configured using an AWS Lambda function.
The correct combination requires using an AWS KMS customer managed key for EBS encryption with automatic key rotation enabled, which rotates keys annually without needing manual intervention or re-encrypting historical data. Additionally, storing the API key in AWS Secrets Manager and configuring automatic rotation via Lambda ensures the secret is rotated every 30 days securely without plaintext exposure.

Adım Adım Çözüm

1
Select the correct encryption strategy for Amazon EBS volumes.
Use an AWS KMS customer managed key with automatic key rotation enabled.
AWS KMS customer managed keys support automatic annual rotation. When rotated, KMS keeps the historical key material to decrypt older data, preventing the need to manually re-encrypt existing snapshots or volumes, which minimizes overhead and avoids downtime.
2
Select the correct management strategy for the external API key.
Store the secret key in AWS Secrets Manager and configure automatic 30-day rotation.
AWS Secrets Manager is the standard service for storing sensitive secrets. It integrates directly with AWS Lambda to automatically execute custom or template-based rotation schedules, keeping the credentials secure and eliminating plaintext storage.

Anahtar Kavram

Data encryption at rest using AWS KMS with automatic key rotation, and secure secret storage using AWS Secrets Manager with automated rotation.
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru