Examkin

Soru

Zorluk: OrtaData Encryption and Key Management

A company stores highly sensitive audit reports in an Amazon S3 bucket. The data is encrypted at rest using an AWS KMS Customer Managed Key (CMK). To comply with updated industry regulations, the security team must rotate the encryption key every year. The team wants to ensure that all historical audit reports can still be accessed and decrypted seamlessly, without requiring manual updates to applications or re-encrypting existing data. Which action should the solutions architect recommend to meet these requirements with the least operational effort?

  1. A
    Create a new Customer Managed Key annually, update the S3 bucket policy to reference the new key, and manually re-encrypt all existing objects using a custom AWS Lambda function.
  2. Enable automatic key rotation for the Customer Managed Key, which generates new key material annually while preserving the older key material to decrypt existing objects.Cevap
  3. C
    Enable automatic key rotation for the Customer Managed Key and configure an AWS Batch job to immediately decrypt and re-encrypt all historical S3 objects using the new key version.
  4. D
    Store the key material as a plaintext parameter in AWS Systems Manager Parameter Store, and write a scheduled script to generate new key material and update the parameter annually.

Cevap

Enable automatic key rotation for the Customer Managed Key, which generates new key material annually while preserving the older key material to decrypt existing objects.
Enabling automatic key rotation for the Customer Managed Key is the most efficient solution. AWS KMS automatically creates new key material every year while keeping the older key material available for decrypting objects that were encrypted with previous key versions. This process requires zero configuration changes or manual re-encryption.

Adım Adım Çözüm

1
Identify the encryption requirement and the constraint regarding historical data access.
The audit reports are encrypted using a Customer Managed Key (CMK) and must be rotated annually with minimal operational effort and without re-encrypting historical data.
This establishes the baseline requirements for standard key rotation behavior in AWS KMS.
2
Evaluate AWS KMS automatic key rotation capabilities.
Enabling automatic key rotation for a CMK automatically generates new key material every year while keeping historical key versions intact to decrypt existing objects.
This eliminates the need for manual key rotation, updating policies, or re-encrypting historical data, satisfying the least operational effort requirement.
3
Select the option that configures automatic key rotation without initiating redundant re-encryption tasks or using insecure parameter configurations.
Enabling automatic key rotation alone meets all criteria.
No other service modifications or data rewrites are required, securing the correct solution.

Anahtar Kavram

AWS KMS Automatic Key Rotation Mechanics
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru