Exam AWS Certified Security - Specialty All Questions

View all questions & answers for the AWS Certified Security - Specialty exam

Exam AWS Certified Security - Specialty topic 1 question 21 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 21
Topic #: 1

[All AWS Certified Security - Specialty Questions]

An organization has a system in AWS that allows a large number of remote workers to submit data files. File sizes vary from a few kilobytes to several megabytes.
A recent audit highlighted a concern that data files are not encrypted while in transit over untrusted networks.
Which solution would remediate the audit finding while minimizing the effort required?

A. Upload an SSL certificate to IAM, and configure Amazon CloudFront with the passphrase for the private key.
B. Call KMS.Encrypt() in the client, passing in the data file contents, and call KMS.Decrypt() server-side.
C. Use AWS Certificate Manager to provision a certificate on an Elastic Load Balancing in front of the web service's servers.
D. Create a new VPC with an Amazon VPC VPN endpoint, and update the web service's DNS record.

Show Suggested Answer

Suggested Answer: C 🗳️

by BillyC at Aug. 27, 2019, 11:44 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

josellama2000

Highly Voted 3 years, 8 months ago

A is incorrect. You can upload a SSL Certificate to a IAM. But when setting the cert up on cloundfront you will use the Cert path (a paraphrase if any will have to be provided bhy the client) https://aws.amazon.com/premiumsupport/knowledge-center/import-ssl-certificate-to-iam/ B is incorrect. This option will required a script or a change in the app code. KMS.Encrypt() is a function from the aws-sdk that can be used inside your code. KMS.Encrypt() and KMS.Dencrypt() are used on the client's side. C is correct. D may wotk but will required more effort than C

upvoted 47 times

Smartphone

3 years, 8 months ago

Well explained!

upvoted 1 times

...

ChauPhan

3 years, 7 months ago

For B. KMS.Encrypt() and Decrypt() is a method to encrypt and decrypt the data key, not application data itself. And the data key cannot over 4Kb The data key (<=4KB) will be used to encrypt/decrypt your LARGE application data. But how protect this data key? That's why it is also encrypted by KMS.Encrypt() and Decrypt() Flow: Master key (CKM) --> Encrypt/Decrypt data key --> Encrypt/Decrypt your real application data Envelope encryption When you encrypt your data, your data is protected, but you have to protect your encryption key. One strategy is to encrypt it. Envelope encryption is the practice of encrypting plaintext data with a data key, and then encrypting the data key under another key.

upvoted 2 times

...

Bach999

3 years, 8 months ago

B is wrong because it doesn't support file size up to several megabytes. If file size is greater than 4k bytes, we must use 'envelope encryption' (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#enveloping)

upvoted 8 times

certking

3 years, 7 months ago

good point, the 4kb limit is mentioned in https://docs.aws.amazon.com/kms/latest/developerguide/programming-encryption.html

upvoted 2 times

...

GeeBeeEl

3 years, 7 months ago

Hi Bach I am not sure the meaning of envelope encryption as you seem to have used it.

upvoted 2 times

...

BillyC

Highly Voted 3 years, 8 months ago

C is Correct!

upvoted 17 times

...

3 years, 4 months ago

Option C --> Low cost, low overhead, best solution

upvoted 1 times

...

jj22222

3 years, 5 months ago

Selected Answer: C

SSL for encryp in transit

upvoted 1 times

...

3 years, 7 months ago

Ans(C) Issue Certificate Manager to Elastic Load Balancer infront f EC2 instances

upvoted 2 times

GeeBeeEl

3 years, 7 months ago

Is this for outbound data? Because if it is for inbound data, it means the data came in without been encrypted. Attempting to encrypt at the ELB is late, you should be decrypting at the ELB!!!

upvoted 2 times

...