Exam AWS Certified Security - Specialty topic 1 question 95 discussion

While C and D are very close to being the same thing, D is the correct answer. https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html To encrypt data outside of AWS KMS: 1. Use the GenerateDataKey operation to get a data key. 2. Use the plaintext data key (in the Plaintext field of the response) to encrypt your data outside of AWS KMS. Then erase the plaintext data key from memory. 3. **** Store the encrypted data key (in the CiphertextBlob field of the response) with the encrypted data. **** To decrypt data outside of AWS KMS: 1. **** Use the Decrypt operation to decrypt the encrypted data key. **** The operation returns a plaintext copy of the data key. 2. Use the plaintext data key to decrypt data outside of AWS KMS, then erase the plaintext data key from memory.

D. Is the definition of envelop encryption, and it is the way things work. A, is the poor and randomly written version of D.

Correct is D. A is incorrect since KMS does NOT handle data keys persistence. You are responsible to envelope that along with the data.

D is correct

A for me

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/introduction.html A formatted message that stores encrypted data keys with the encrypted data The AWS Encryption SDK stores the encrypted data and encrypted data key together in an encrypted message that uses a defined data format. This means you don't need to keep track of or protect the data keys that encrypt your data because the AWS Encryption SDK does it for you. Some language implementations of the AWS Encryption SDK require an AWS SDK, but the AWS Encryption SDK doesn't require an AWS account and it doesn't depend on any AWS service. You need an AWS account only if you choose to use AWS KMS keys to protect your data. answer D

i honestly do not know the answer but D looks smooth to me.

Answer:A. Why do we need KMS if the key is stored in the application? Also storing the key along with the data is a serious vulnerability.

Answer:D Use AWS SDK client-side encryption that secure app data with private encryption keys never leave the application. Use Option 2 of the following link. https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html Wrong answers: A, B - Sending unencrypted/plaintext data key over to and fro application is unsafe. C- If another CMK is required (Option 1 of the above link) then the solution should mention the calling of AWS KMS to return plaintext version and cipher blob version of a generated data key, where it will use plaintext data key to encrypt at client side. Again, this is less secure than D since it involve sending of plaintext data key.

Ans: D

You don't need to use the Encrypt operation to encrypt a data key. The GenerateDataKey and GenerateDataKeyPair operations return a plaintext data key and an encrypted copy of that data key.

I don't know the difference between A and D.

D makes sense