Examkin

Soru

Zorluk: ZorData Encryption and Key Management

A company is designing the security architecture for a new financial application. The application stores sensitive transaction records in an Amazon S3 bucket and connects to an Amazon RDS database. The company's compliance policy mandates the following security controls:
1. The database credentials must be rotated automatically every 30 days.
2. The S3 bucket objects must be encrypted at rest using a KMS Customer Managed Key (CMK) that is rotated annually.
3. Historical S3 objects must remain decryptable without manual intervention or data re-encryption.

Which combination of configurations will meet these security requirements with the least operational overhead?

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK) and enable automatic key rotation.Cevap
  2. B
    Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK) and enable automatic key rotation.
  3. C
    Store the database credentials in AWS Secrets Manager and configure automatic rotation. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK), manually rotate the key annually by creating a new CMK, and delete the previous CMK.
  4. D
    Store the database credentials in AWS Secrets Manager. Use the AWS account root user credentials to configure a custom script that rotates the database credentials. For the S3 bucket, configure default encryption using the AWS managed key (aws/s3) and enable automatic key rotation.

Cevap

Store the database credentials in AWS Secrets Manager and configure automatic rotation. For the S3 bucket, configure default encryption using a Customer Managed Key (CMK) and enable automatic key rotation.
The correct solution stores the database credentials in AWS Secrets Manager, which natively manages automatic rotation. For S3, utilizing an AWS KMS Customer Managed Key (CMK) with automatic rotation enabled satisfies the annual rotation requirement. When automatic key rotation is enabled, AWS KMS rotates the backing key material annually while keeping the same key ARN. Crucially, AWS KMS retains older backing key material to decrypt historical objects, ensuring that older files remain decryptable without manual intervention or data re-encryption.

Adım Adım Çözüm

1
Evaluate database credentials security and rotation requirements.
AWS Secrets Manager is chosen to store the database credentials, enabling native automatic rotation (e.g., every 30 days) using an integrated AWS Lambda function.
This meets the automatic credential rotation requirement securely and with low operational overhead compared to custom scripts or plaintext parameters.
2
Select the encryption method and key management approach for the Amazon S3 bucket.
Configure default S3 bucket encryption using an AWS KMS Customer Managed Key (CMK) and enable automatic key rotation.
Automatic key rotation satisfies the annual rotation mandate. It maintains the same key ARN and key policies, while AWS KMS automatically retains old key material to decrypt historical S3 objects without manual intervention.
3
Avoid security practices that violate least privilege or compromise key recoverability.
Ensure that the root user is not used for configuration scripts, and that manual key deletion is avoided to prevent permanent loss of decryption capabilities for historical data.
This guarantees compliance with AWS security best practices and the requirement to keep historical backups readable.

Anahtar Kavram

AWS KMS Customer Managed Key automatic rotation mechanics and AWS Secrets Manager integration for database credentials rotation.
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru