Examkin

Soru

Zorluk: KolayData Encryption and Key Management

An operations team is setting up a deployment pipeline and needs to store a sensitive API token that Amazon ECS tasks will use to access a third-party service. The solutions architect decides to store the token in AWS Systems Manager Parameter Store. Which configuration should the solutions architect choose to store and protect the token?

  1. A
    Create a Parameter Store parameter using the String type, storing the token directly in the parameter value to reduce API latency.
  2. B
    Create a Parameter Store parameter using the String type, and rely on AWS KMS automatic key rotation to secure the plaintext value.
  3. Create a Parameter Store parameter using the SecureString type, which encrypts the token using an AWS Key Management Service (AWS KMS) key.Cevap
  4. D
    Create a Parameter Store parameter using the SecureString type, expecting that rotating the underlying KMS key will immediately re-encrypt all historical parameter versions.

Cevap

Create a Parameter Store parameter using the SecureString type, which encrypts the token using an AWS Key Management Service (AWS KMS) key.
The correct option is to use a SecureString parameter in Systems Manager Parameter Store. This configuration automatically encrypts the sensitive API token at rest using an AWS KMS key. This prevents unauthorized users from viewing the credentials in plaintext and adheres to AWS security best practices.

Adım Adım Çözüm

1
Identify the security requirement for the sensitive API token.
The API token is sensitive credential data that must be encrypted at rest.
Storing credentials in plaintext poses a security risk.
2
Evaluate Systems Manager Parameter Store parameter types.
The String type stores values in plaintext, while the SecureString type encrypts values using AWS KMS.
SecureString is the correct parameter type for sensitive data.
3
Determine the impact of KMS key rotation on stored secrets.
Rotating a KMS key generates a new backing key for new encryption requests, but does not re-encrypt existing ciphertext or affect plaintext parameters.
Understanding key rotation mechanics ensures correct architectural assumptions.

Anahtar Kavram

Using Systems Manager Parameter Store SecureString parameters encrypted with AWS KMS to securely store sensitive configuration data.
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru