Exam AWS Certified Data Analytics - Specialty topic 1 question 67 discussion

Answer is B Authentication: https://docs.aws.amazon.com/quicksight/latest/user/external-identity-providers-setting-up-saml.html#external-identity-providers-config-idp Encryption: https://docs.aws.amazon.com/quicksight/latest/user/data-encryption-at-rest.html "All keys associated with Amazon QuickSight are managed by AWS." in https://docs.aws.amazon.com/quicksight/latest/user/key-management.html - No way to use customer-provided keys in QuickSight

All Keys are managed by QuickSight enterprise edition and hence D can not be the answer. I would go with B

Answer is B. An AWS Organization is required to use IAM Identity Center with AD Connector. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ad_connector_getting_started.html, https://docs.aws.amazon.com/quicksight/latest/user/aws-directory-service.html Since the univerasity does not has an AWS Organization and did not mention that they need one. Option B would b a more feasible option

ChatGPT chose answer D.

Option D mentioned using AD Connector and configuring Amazon QuickSight to use customer-provided keys imported into AWS Key Management Service (KMS). While using customer-provided keys in AWS KMS for encryption offers additional control over encryption keys, the question does not specify a requirement that necessitates this level of key management. Additionally, the AD Connector is not a feature of Amazon QuickSight; instead, the Enterprise edition supports direct AD integration. Therefore, option B is the correct solution, as it leverages the capabilities of Amazon QuickSight Enterprise edition to meet the university’s requirements for Active Directory authentication and data encryption.

Correct answer

Probably B is correct when the problem was created in the past. but now D looks like also correct.(AD connecter looks like very easy) Encryption method is not defined in the sentence. so B is more correct.It is less effort.ummm

Ans :D

B : SAML 2.0 works with AD, Enterprise Edition offers encryption at rest. All data is encrypted in transit by default https://docs.aws.amazon.com/quicksight/latest/user/data-encryption-in-transit.html

B: I passed the test

QuickSight enables you to encrypt your SPICE datasets using the keys you have stored in AWS Key Management Service. This provides you with the tools to audit access to data and satisfy regulatory security requirements. If you need to do so, you have the option to immediately lock down access to your data by revoking access to AWS KMS keys.

D seems to be right. Reason: it is stated that user authentication must be via Microsoft Active Directory. This rules out options A, B and C. A and B mention SAML, C mentions an AD Connector but this is only supported in the Enterprise Edition. Source: https://docs.aws.amazon.com/quicksight/latest/user/directory-integration.html and https://docs.aws.amazon.com/quicksight/latest/user/aws-directory-service.html. And yes it is possible to use CMKs with aws managed KMS, even for SPICE data not just meta data. Source: https://docs.aws.amazon.com/quicksight/latest/user/key-management.html - Using customer-managed keys from AWS KMS with SPICE datasets in Amazon QuickSight

D is the right answer https://docs.aws.amazon.com/quicksight/latest/user/aws-directory-service.html

To create customer-managed keys (CMKs), you use AWS Key Management Service (AWS KMS) in the same AWS account and AWS Region as the Amazon QuickSight SPICE dataset. A QuickSight administrator can then use a CMK to encrypt SPICE datasets and control access. https://docs.aws.amazon.com/quicksight/latest/user/key-management.html

QuickSight enables you to encrypt your SPICE datasets using the keys you have stored in AWS Key Management Service. This provides you with the tools to audit access to data and satisfy regulatory security requirements. If you need to do so, you have the option to immediately lock down access to your data by revoking access to AWS KMS keys. All data access to encrypted datasets in QuickSight SPICE is logged in AWS CloudTrail. Administrators or auditors can trace data access in CloudTrail to identify when and where data was accessed. To create customer-managed keys (CMKs), you use AWS Key Management Service (AWS KMS) in the same AWS account and AWS Region as the Amazon QuickSight SPICE dataset. A QuickSight administrator can then use a CMK to encrypt SPICE datasets and control access.

Answer should be D. This allow the use of customer managed keys: https://docs.aws.amazon.com/quicksight/latest/user/key-management.html And easy enabling of AD

Answer is B