Exam AWS Certified Security - Specialty topic 1 question 320 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 320
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A company wants to monitor the deletion of customer managed CMKs. A security engineer must create an alarm that will notify the company before a CM׀ is deleted. The security engineer has configured the integration of AWS CloudTrail with Amazon CloudWatch.
What should the security engineer do next to meet this requirement?

A. Within AWS Key Management Service (AWS KMS), specify the deletion time of the key material during CMK creation. AWS KMS will automatically create a CloudWatch alarm.
B. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to look for API calls of DeleteAlias. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the Eventbridge (CloudWatch Events) rule.
C. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to look for API calls of DisableKey and ScheduleKeyDeletion. Create an AWS Lambda function to send an Amazon Simple Notification Service (Amazon SNS) message to the company. Add the Lambda function as the target of the Eventbridge (CloudWatch Events) rule.
D. Create an Amazon Simple Notification Service (Amazon SNS) policy to look for AWS Key Management Service (AWS KMS) API calls of RevokeGrant and ScheduleKeyDeletion. Create an AWS Lambda function to generate the alarm and send the notification to the company. Add the Lambda function as the target of the SNS policy.

Show Suggested Answer

Suggested Answer: C 🗳️

by MungKey at Sept. 2, 2022, 1:41 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Toptip

2 years ago

Selected Answer: C

C is correct

upvoted 2 times

...

ITGURU51

2 years, 1 month ago

ScheduleKeyDeletion is an operation in AWS Key Management Service that schedules the deletion of a KMS key. By default, AWS KMS applies a waiting period of 30 days, but you can specify a waiting period of 7-30 days. When this operation is successful, the key state of the KMS key changes to PendingDeletion and the key can’t be used in any cryptographic operations. C

upvoted 1 times

...

Root_Access

2 years, 9 months ago

Selected Answer: C

Here is an example in cloudtrail: https://docs.aws.amazon.com/kms/latest/developerguide/ct-schedule-key-deletion.html

upvoted 4 times

...

MungKey

2 years, 10 months ago

C: https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-and-remediate-scheduled-deletion-of-aws-kms-keys.html

upvoted 3 times

...