Examkin

Soru

Zorluk: OrtaData Encryption and Key Management

An online medical ticketing platform processes patient consultation logs using an application running on Amazon ECS. The platform must store these logs in an Amazon DynamoDB table. The compliance team mandates that the logs at rest be encrypted using a customer managed key (CMK) in AWS KMS, with the encryption key automatically rotated on an annual basis. In addition, a third-party medical API access token used by the application must be kept secure and hidden from plain sight. Which architecture configuration will satisfy these requirements?

  1. Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key with automatic key rotation enabled. Store the API access token as a SecureString parameter in AWS Systems Manager Parameter Store.Cevap
  2. B
    Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key with automatic key rotation enabled. Store the API access token as a standard String parameter in AWS Systems Manager Parameter Store.
  3. C
    Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key. Set up an annual AWS Lambda function to rotate the key and re-encrypt all historical table records using the new key material.
  4. D
    Log in with the AWS account root user to configure DynamoDB table encryption with an AWS managed key. Store the API access token as a plaintext environment variable inside the ECS task definition.

Cevap

Configure the DynamoDB table to encrypt data at rest using a customer managed KMS key with automatic key rotation enabled, and store the API access token as a SecureString parameter in AWS Systems Manager Parameter Store.
Using a customer managed KMS key with automatic key rotation enabled meets the encryption and rotation requirements. When a customer managed key is automatically rotated, AWS KMS automatically generates new key material annually. KMS retains all historical versions of the key material to decrypt data encrypted with those versions, so there is no need to manually decrypt and re-encrypt existing DynamoDB table data. Storing the sensitive API access token as a SecureString parameter in Systems Manager Parameter Store ensures the credential is encrypted at rest and not stored in plaintext.

Adım Adım Çözüm

1
Select the correct encryption key type and configuration
A customer managed KMS key is selected with automatic key rotation enabled.
This satisfies the security requirement to use a customer managed key (CMK) and automates the annual rotation without requiring manual script intervention or key material management.
2
Address key rotation and historical data access mechanics
Identify that AWS KMS automatically manages decryption of older records.
AWS KMS retains older versions of rotated key material to decrypt data encrypted with those versions, eliminating the need to decrypt and re-encrypt historical data.
3
Choose the secure storage option for the API token
The token is stored as a SecureString in AWS Systems Manager Parameter Store.
A SecureString parameter encrypts the sensitive token at rest using a KMS key, satisfying the requirement to keep the secret secure and hidden from plain sight.

Anahtar Kavram

AWS KMS key rotation mechanics allow automatic annual generation of new key material for customer managed keys without requiring re-encryption of existing data. Sensitive configuration data should be stored securely using SSM Parameter Store SecureString parameters or AWS Secrets Manager to prevent exposure in plaintext.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Data Encryption and Key Management

Bu konudan daha fazla soru