Exam AWS Certified Data Analytics - Specialty topic 1 question 69 discussion

B. https://docs.aws.amazon.com/streams/latest/dev/what-is-sse.html

Correct answer is B as Kinesis Data Streams supports data at rest encryption using Server-Side encryption. Data is encrypted before persisting and decrypted before being read by the consumers and requires no changes to producers and consumers. Options A & C are wrong as it would require coding effort. Option D is wrong as the default key cannot be rotated.

B is correct. D is wrong - AWS Managed keys are rotated but as per AWS not as per customer. Here customer want rotation capability and they might want to do it number of times in a year.

B: I passed the test

Selected Answer: B

It should be B. B describes the method to encrypt your data at rest inside your Kinesis Data Streams. Option D is the only valid alternative given the constraints, but there is no valid method to rotate this key yourself. So I would argue this key is not rotatable.

Vote for B. I think "rotatable key" means you can rotate manually, it should be CMK, not AWS managed key. D said "using the default KMS key", it is saying to use AWS managed key. So it's not right.

I'd say D: A and C are out because they involve more coding. B would work, but key rotation of CMK is disabled by default and the answer did not say to enable it (but mentions creation and alias, so that was likely left out on purpose) D works, is the simplest and the key is rotated by default (no every year, used to be every 3 years) Paragraph "Customer managaged keys" in https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-aws-owned-keys

Answer - B

B is the right answer

B is the right answer

The Answer is B. You cannot rotate "AWS Managed CMK" i.e. Default keys. It is automatically rotated every 3 years. https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html

"key that can be rotated" it is talking about CMK. B must be the answer.

Just checked the Kinesis console. You can select either the default or the CMK for encryption at rest. Since rotation can be set for the CMK, B is the answer.

D. the FAQ's https://aws.amazon.com/kinesis/data-streams/faqs/#kinesis-encryption question : "What is server-side encryption" It mentions "Server-side encryption for Kinesis Data Streams automatically encrypts data using a user specified AWS KMS master key (CMK) "

B. it's written here: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html You cannot rotate key that you did not create

It should be B. Here is the link, https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html