Examkin

Soru

Zorluk: OrtaData Encryption and Key Management

A company stores historical compliance reports in an Amazon S3 bucket. The reports are encrypted at rest using Server-Side Encryption with an AWS KMS customer managed key (SSE-KMS). To satisfy new security standards, a solutions architect enables automatic annual key rotation for this KMS key. Which of the following describes the impact of this configuration on the historical reports and future write operations?

  1. AWS KMS retains the previous backing key material to seamlessly decrypt historical reports, while any newly uploaded reports are encrypted using the new backing key material under the same KMS key ARN.Cevap
  2. B
    AWS KMS automatically schedules a background job to decrypt and re-encrypt all existing S3 objects with the new backing key material to ensure consistent encryption across all historical reports.
  3. C
    The solutions architect must manually download, decrypt, and re-upload the historical reports to re-encrypt them, because the previous backing key material is permanently deleted upon rotation.
  4. D
    The solutions architect must export the legacy backing key material and save it as a plaintext parameter of type String in Systems Manager Parameter Store to allow historical reports to be decrypted.

Cevap

AWS KMS retains the previous backing key material to seamlessly decrypt historical reports, while any newly uploaded reports are encrypted using the new backing key material under the same KMS key ARN.
The correct answer correctly states that AWS KMS retains historical backing key material to seamlessly decrypt legacy objects. S3 reads are transparently decrypted using the appropriate historical key version, whereas all new uploads are encrypted with the newly generated backing key material. The external KMS key metadata, including its ARN and Key ID, remains unchanged, meaning no updates to bucket policies or application code are needed.

Adım Adım Çözüm

1
Analyze the automatic key rotation behavior of AWS KMS customer managed keys.
Automatic rotation generates new cryptographic backing key material annually, while keeping the key's metadata (Key ID, ARN, and policies) unchanged.
This allows applications to continue referencing the same KMS key without code modifications.
2
Determine the impact of rotation on existing (historical) encrypted data.
AWS KMS preserves the older backing key material versions to decrypt data that was encrypted under those versions.
Rotating the key does not automatically re-encrypt existing data, as doing so would be resource-intensive and expensive.
3
Determine the impact of rotation on new write operations.
New data write requests (such as new S3 uploads) will automatically be encrypted using the newly generated backing key material.
This ensures that all future data writes use the latest, rotated key material.

Anahtar Kavram

AWS KMS automatic key rotation preserves legacy backing key versions to decrypt historical data while using the new backing key version for new encryption operations, keeping the key's metadata unchanged.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru