Exam AWS Certified Security - Specialty All Questions

View all questions & answers for the AWS Certified Security - Specialty exam

Exam AWS Certified Security - Specialty topic 1 question 230 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 230
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A company wants to encrypt data locally while meeting regulatory requirements related to key exhaustion. The encryption key can be no more than 10 days old or encrypt more than 2^16 objects. Any encryption key must be generated on a FIPS-validated hardware security module (HSM). The company is cost-conscious, as it plans to upload an average of 100 objects to Amazon S3 each second for sustained operations across 5 data producers.
Which approach MOST efficiently meets the company's needs?

A. Use the AWS Encryption SDK and set the maximum age to 10 days and the maximum number of messages encrypted to 2^16. Use AWS Key Management Service (AWS KMS) to generate the master key and data key. Use data key caching with the Encryption SDK during the encryption process.
B. Use AWS Key Management Service (AWS KMS) to generate an AWS managed CMK. Then use Amazon S3 client-side encryption configured to automatically rotate with every object.
C. Use AWS CloudHSM to generate the master key and data keys. Then use Boto 3 and Python to locally encrypt data before uploading the object. Rotate the data key every 10 days or after 2^16 objects have been uploaded to Amazon S3.
D. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) and set the master key to automatically rotate.

Show Suggested Answer

Suggested Answer: A 🗳️

by khamrumunnu at Jan. 1, 2022, 11:29 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

trongod05

Highly Voted 3 years, 2 months ago

It says this. "Any encryption key must be created on a hardware security module." KMS is not an HSM. Wouldn't you have to go with C?

upvoted 7 times

helpaws

3 years ago

KMS uses an FIPS HSM that has been validated under FIPS 140-2. link: https://aws.amazon.com/kms/faqs/#:~:text=The%20service%20uses%20an%20FIPS,the%20security%20of%20your%20keys.

upvoted 4 times

...

ITGURU51

2 years, 3 months ago

KMS uses HSM FIPS validated hardware.

upvoted 2 times

...

samCarson

Most Recent 2 years, 1 month ago

Selected Answer: A

Option A is the most efficient choice as it meets regulatory requirements by setting a maximum key age of 10 days and maximum number of encrypted objects. It utilizes AWS KMS to generate keys on a FIPS-validated HSM, ensuring security. By using the AWS Encryption SDK with data key caching, it optimizes performance by reusing keys, while being cost-conscious as the SDK is free and open-source.

upvoted 3 times

...

pal40sg

2 years, 2 months ago

Selected Answer: A

both options A and C are valid approaches, but option A using the AWS Encryption SDK with AWS KMS is generally considered more efficient and easier to implement in a cost-conscious environment.

upvoted 2 times

...

ITGURU51

2 years, 3 months ago

AWS Encryption SDK is a client side encryption library that is provided free of charge. On the other hand AWS CloudHSM requires organizations to pay by the hour. The business requirement states that cost effective security controls for encryption need to be implemented. A

upvoted 1 times

...

nairj

2 years, 4 months ago

Answer is A : AWS KMS uses FIPS compliant HSM

upvoted 2 times

...

Nan001

2 years, 5 months ago

Selected Answer: A

The most efficient approach that meets the company's needs is A. Here's why: AWS KMS is FIPS-validated and can generate both master keys and data keys. The AWS Encryption SDK can be used to encrypt data and set the maximum age and number of objects per key. Data key caching can also help reduce the number of requests to KMS. Option B involves the automatic rotation of AWS KMS-managed customer master keys (CMKs), but it does not meet the requirement for the key to be generated on an HSM. Option C, while it meets the regulatory requirements, adds complexity to the application design, and data key rotation must be handled carefully to ensure that all data is recoverable. Using server-side encryption with Amazon S3 managed encryption keys (SSE-S3) and automatic key rotation (D) can be a simpler option but would not meet the regulatory requirements related to key exhaustion. Therefore, A is the best choice.

upvoted 1 times

...

jishrajesh

2 years, 7 months ago

Selected A

upvoted 1 times

...

sapien45

2 years, 11 months ago

Selected Answer: A

A command line is better than 1000 words. https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/implement-caching.html # Security thresholds # Max entry age is required. # Max messages (and max bytes) per entry are optional # MAX_ENTRY_AGE_SECONDS = 60.0 MAX_ENTRY_MESSAGES = 10 # Create a caching CMM caching_cmm = CachingCryptoMaterialsManager( master_key_provider=key_provider, cache=cache, max_age=MAX_ENTRY_AGE_SECONDS, max_messages_encrypted=MAX_ENTRY_MESSAGES )

upvoted 2 times

...

Lanka22

3 years ago

Selected Answer: C

C - Any encryption key must be created on a hardware security module (CloudHSM)

upvoted 2 times

...

TigerInTheCloud

3 years, 4 months ago

Selected Answer: A

C is overkilled. KMS satisfies the request of 'certified by FIPS (HSM)' as it uses FIPS 140-2 validated hardware security modules (HSM) and supports FIPS 140-2 validated endpoints (backed by CloudHSM) KMS on level 2, CouldHSM on Level3

upvoted 1 times

...

mx677

3 years, 5 months ago

Selected Answer: A

A: AWS Encryption SDK, you can configure data key caching to allow just enough data key reuse to meet your cost and performance targets while conforming to the security requirements of your application.

upvoted 1 times

...

lotfi50

3 years, 5 months ago

Selected Answer: A

the answer is A

upvoted 2 times

...

darknight88

3 years, 6 months ago

A ----https://aws.amazon.com/blogs/security/aws-encryption-sdk-how-to-decide-if-data-key-caching-is-right-for-your-application/

upvoted 1 times

...

Radhaghosh

3 years, 6 months ago

Option A only Valid Option

upvoted 2 times

...

aguijap

3 years, 7 months ago

A -- https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/data-key-caching.html

upvoted 4 times

sam_live

3 years, 6 months ago

Option A is correct. Caching can reduce your use of cryptographic services, such as AWS Key Management Service (AWS KMS). If you are hitting your AWS KMS requests-per-second limit, caching can help. Your application can use cached keys to service some of your data key requests instead of calling AWS KMS.

upvoted 3 times

...

khamrumunnu

3 years, 7 months ago

Answer is C Encrypt Data on-premises

upvoted 4 times

LearnMeSomeAWS

3 years, 7 months ago

agree C - its the only FIPS compliant option as well.

upvoted 1 times

yqoswlyilylqw

3 years, 6 months ago

That isn't true. KMS is FIPS compliant, albeit to Level2 only. The question doesn't mention a specific FIPS level, it just mentions being FIPS compliant. Also, the question mentions cost as a concern and CloudHSM is far more expensive per hr than KMS. Therefore, A is correct.

upvoted 5 times

trongod05

3 years, 2 months ago

But it mentions "Any encryption key must be created on a hardware security module." KMS is not an HSM.

upvoted 1 times

nairj

2 years, 4 months ago

KMS Uses a HSM in the backend to create Keys but is multi-tenant where as CloudHSM is dedicated and you manage thekey creation process. The question here says that the HSM has to be FIPS compliant, doesn't mention about who maintains the HSM . https://docs.aws.amazon.com/crypto/latest/userguide/awscryp-choose-hsm.html

upvoted 1 times

...