Exam AWS Certified Security - Specialty topic 1 question 108 discussion

Answer: C https://aws.amazon.com/blogs/security/how-to-protect-the-integrity-of-your-encrypted-data-by-using-aws-key-management-service-and-encryptioncontext/

Answer is C, One of the most important and critical concepts in AWS Key Management Service (KMS) for advanced and secure data usage is EncryptionContext. Using EncryptionContext properly can help significantly improve the security of your applications. EncryptionContext is a key-value map (both strings) that is provided to KMS with each encryption and decryption request. EncryptionContext provides three benefits: Additional authenticated data (AAD), Audit trail, Authorization context ...

AAD > EncryptionContext. Correct answer is C

C - is correct https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context

Answer: C https://docs.aws.amazon.com/crypto/latest/userguide/cryptography-concepts.html#term-aad additional authenticated data (AAD) Nonsecret data that is provided to encryption and decryption operations to add an additional integrity and authenticity check on the encrypted data. Typically, the decrypt operation fails if the AAD provided to the encrypt operation does not match the AAD provided to the decrypt operation. AWS Key Management Service (AWS KMS) and the AWS Encryption SDK both support AAD by using an encryption context.

EncryptionContext is KMS’s implementation of AAD. I highly recommend that you use it to ensure that unencrypted data related to the ciphertext is protected against tampering. C

C. Use kms:EncryptionContext as a condition when defining IAM policies for the CMK. kms:EncryptionContext can be used to ensure that the data being encrypted is tagged with a specific context, such as a resource or user ID. This tag can then be used as a condition in the IAM policy for the CMK, allowing the Security Engineer to control which IAM users and roles are able to use the CMK to encrypt or decrypt data based on the context of the data being processed.

At its core, using authenticated encryption prevents tampering with ciphertext itself. Authenticated encryption is built into KMS, so if you can successfully decrypt a message using KMS, an authorized user must have created that message. You can almost think of this as providing a “signature” over the ciphertext.

kms:EncryptionContext helps against tampering of the cypher text.

additional authenticated data (AAD) => kms:EncryptionContext

Answer C --> Encryption Context

C it is. This question is commonly available from other sources as well.

The answer is C the answer to the question says D but then points to a document that talks about AAD and is encryption context. Hope this helps guys encryption context A type of additional authenticated data (AAD) (p. 2). It typically consists of nonsecret, arbitrary, name–value pairs. In most cases, you can provide an encryption context when you encrypt data. The same encryption context must be provided to decrypt the data. The encryption context is usually optional but recommended. The term encryption context has different meanings in various AWS services and tools. This can be confusing, so be sure to understand how your tool or service interprets this term.

C is correct

Ans is C

C for me

Answer is C