Examkin

Soru

Zorluk: OrtaData Encryption and Key Management

A company stores large archives in an Amazon S3 bucket. The data is encrypted at rest using an AWS KMS Customer Managed Key (CMK). A new compliance policy requires that the encryption keys be rotated annually. The security team wants to ensure that all historical data remains readable without manual intervention, while new data is encrypted using the rotated key material.

Which configuration meets these requirements with the least administrative effort?

  1. A
    Create a new Customer Managed Key annually, associate it with the S3 bucket, and delete the older Customer Managed Key to reduce key management costs.
  2. Enable automatic key rotation for the existing Customer Managed Key.Cevap
  3. C
    Export the KMS key material, store it as a plaintext String parameter in AWS Systems Manager Parameter Store, and use an AWS Lambda function to rotate it annually.
  4. D
    Manually create a new Customer Managed Key each year, update the S3 bucket configuration, and re-encrypt all historical data using S3 Batch Operations.

Cevap

Enable automatic key rotation for the existing Customer Managed Key.
Enabling automatic key rotation on an AWS KMS Customer Managed Key (CMK) automatically schedules rotation of the backing key material once a year. When this occurs, AWS KMS keeps all older key material active so it can decrypt any historical ciphertexts. Newly written files will automatically be encrypted using the newly generated key material. This achieves compliance with zero management overhead and zero downtime.

Adım Adım Çözüm

1
Identify the primary requirement for annual rotation of a Customer Managed Key (CMK) in AWS KMS.
The requirement is to rotate the key annually, ensure historical data remains readable, and minimize administrative overhead.
Establishing the objective allows selecting the solution with the lowest management overhead and highest compliance.
2
Evaluate the native rotation mechanism of AWS KMS Customer Managed Keys.
Enabling automatic key rotation on a CMK generates a new key version annually. AWS KMS retains older key material indefinitely to decrypt historical ciphertexts automatically.
This shows that re-encryption of historical data or updating the bucket configurations is not required.
3
Compare against options involving manual rotation, deletion, and Parameter Store.
Deleting old keys causes data loss, manually re-encrypting historical data introduces high cost and complexity, and exporting key material to plaintext Parameter Store parameters introduces major security risks.
By eliminating complex or insecure workarounds, the native KMS automatic rotation is confirmed as the correct path.

Anahtar Kavram

AWS KMS Automatic Key Rotation
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru