Exam AWS Certified Security - Specialty topic 1 question 41 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 41
Topic #: 1

[All AWS Certified Security - Specialty Questions]

The Development team receives an error message each time the team members attempt to encrypt or decrypt a Secure String parameter from the SSM
Parameter Store by using an AWS KMS customer managed key (CMK).
Which CMK-related issues could be responsible? (Choose two.)

A. The CMK specified in the application does not exist.
B. The CMK specified in the application is currently in use.
C. The CMK specified in the application is using the CMK KeyID instead of CMK Amazon Resource Name.
D. The CMK specified in the application is not enabled.
E. The CMK specified in the application is using an alias.

Show Suggested Answer

Suggested Answer: AD 🗳️

by BillyC at Aug. 25, 2019, 5:45 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

mojoa

Highly Voted 3 years, 9 months ago

Most of the Parameter Store failures related to CMKs are caused by the following problems: The credentials that an application is using do not have permission to perform the specified action on the CMK. To fix this error, run the application with different credentials or revise the IAM or key policy that is preventing the operation. For help with AWS KMS IAM and key policies, see Authentication and Access Control for AWS KMS. The CMK is not found. This typically happens when you use an incorrect identifier for the CMK. Find the correct identifiers for the CMK and try the command again. The CMK is not enabled. When this occurs, Parameter Store returns an InvalidKeyId exception with a detailed error message from AWS KMS. If the CMK state is Disabled, enable it. If it is Pending Import, complete the import procedure. If the key state is Pending Deletion, cancel the key deletion or use a different CMK. To find the key state of a CMK in the AWS KMS console, on the Customer managed keys or AWS managed keys page, see the Status column. To use the AWS KMS API to find the status of a CMK, use the DescribeKey operation.

upvoted 34 times