Examkin

Soru

Zorluk: OrtaData Encryption and Key Management

A solutions architect is designing a security strategy for a financial services company. The company requires customer-managed keys (CMKs) in AWS Key Management Service (AWS KMS) to encrypt sensitive data stored in Amazon S3 buckets. The company's compliance policy mandates that the key material must be rotated annually. However, historical data must remain readable, and administrative overhead must be minimized.

Which TWO statements accurately describe the mechanics and implications of enabling automatic key rotation for these customer-managed keys?

  1. AWS KMS automatically retains all previous versions of the key material to ensure that historical data can still be decrypted.Cevap
  2. Enabling automatic key rotation does not automatically re-encrypt existing S3 objects that were encrypted using the older key material.Cevap
  3. C
    Rotating the key material automatically initiates an AWS Batch job to decrypt and re-encrypt all historical data with the new key version.
  4. D
    To simplify key administration, the database credentials used by applications that access the encrypted S3 buckets should be stored as plain String parameters in AWS Systems Manager Parameter Store.
  5. E
    To decrypt older S3 objects after rotation, the solutions architect must manually create and configure a unique KMS key alias for each retired version of the key material.

Cevap

AWS KMS automatically retains all previous versions of the key material to ensure that historical data can still be decrypted, and enabling automatic key rotation does not automatically re-encrypt existing S3 objects that were encrypted using the older key material.
The correct options accurately describe how AWS KMS handles key rotation. First, AWS KMS automatically retains all previous versions of the key material, allowing the service to seamlessly decrypt historical data without manual configuration. Second, rotating key material does not automatically re-encrypt existing S3 objects, which remain encrypted under their original key material version.

Adım Adım Çözüm

1
Analyze AWS KMS key rotation behavior for customer-managed keys.
Identified that automatic rotation generates a new version of key material annually while retaining previous versions.
To determine how historical data remains accessible without administrative intervention.
2
Evaluate the impact of rotation on existing S3 objects.
Understood that existing objects are not automatically re-encrypted with the new key material; they continue to use the version of the key material active at their creation.
To rule out misconceptions about automatic background re-encryption of historical data.
3
Assess secret storage and alias management requirements.
Confirmed that no manual alias configurations are needed for old versions and that credentials should never be stored as plaintext String parameters.
To ensure compliance with security best practices and eliminate incorrect options.

Anahtar Kavram

AWS KMS Customer Managed Key automatic rotation mechanics and behavior.
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru