Exam AWS Certified Security - Specialty topic 1 question 10 discussion

Agree, A is the correct answer.

No. Even if not explicitly stated, KMS uses a unique key for each object.

Here is an example of how to write a Key policy with MFA + also how to integrate the MFA itself into your application (so you can authenticate yourself in with your application) https://mariadb.com/kb/en/aws-key-management-encryption-plugin-advanced-usage/#using-a-multi-factor-authentication-mfa-device Key policy for MFA should look like this btw: "Condition": { "Bool": { "aws:MultiFactorAuthPresent": "True" } },

SSE-KMS ensures each object is encrypted with a unique data key generated and encrypted by your CMK. https://docs.aws.amazon.com/AmazonS3/latest/dev/serv-side-encryption.html When you use Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3), each object is encrypted with a unique key erver-Side Server-Side Encryption with Customer Master Keys (CMKs) Stored in AWS Key Management Service (SSE-KMS) is similar to SSE-S3

Answer is A.(See the last line) Reference: https://jayendrapatil.com/tag/kms/ SSE-KMS provides the option to create and manage encryption keys yourself, or use a default customer master key (CMK) that is unique to you, the service you’re using, and the region you’re working in. Creating and Managing your own CMK gives you more flexibility, including the ability to create, rotate, disable, and define access controls, and to audit the encryption keys used to protect your data. Data keys used to encrypt your data are also encrypted and stored alongside the data they protect and are unique to each object