DOP-C02 Question 389
Select 3Your organization is migrating sensitive financial data to AWS. Regulatory compliance mandates that the data must be encrypted at rest and that access to the encryption keys must be limited to specific IAM roles. Additionally, the organization requires the ability to audit key usage and ensure that only approved personnel can create, rotate, and delete keys. Which combination of AWS services and configurations should you implement to meet these requirements?
- A
Use AWS Key Management Service (AWS KMS) to create and manage customer-managed keys, and assign specific IAM roles for key administration and usage.
- B
Enable AWS CloudTrail to log all KMS API calls for auditing purposes.
- C
Store the encryption keys in Amazon S3 with server-side encryption (SSE-S3) to simplify key management.
- D
Use AWS Secrets Manager to store and rotate encryption keys.
- E
Enable automatic key rotation in AWS KMS and configure access controls using key policies.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the requirement of encrypting data at rest with strict access controls and auditing capabilities, AWS KMS is the most appropriate service. It enables you to create customer-managed keys, enforce access controls via IAM roles and key policies, and configure automatic key rotation. AWS CloudTrail logs all KMS API calls, providing the necessary audit trail. While SSE-S3 and Secrets Manager are useful services, they do not address the specific requirements for encryption key management in this scenario.
- A. Correct.
Correct: AWS KMS is purpose-built for managing encryption keys, and you can use it to create customer-managed keys with fine-grained access controls through IAM roles and key policies.
- B. Correct.
Correct: AWS CloudTrail is a key service for auditing KMS API calls, which is essential for tracking key usage and meeting compliance requirements.
- C. Incorrect.
Incorrect: Amazon S3 with SSE-S3 does not provide the level of control and auditing required for encryption key management in this scenario.
- D. Incorrect.
Incorrect: AWS Secrets Manager is used for managing secrets like database credentials, not for managing encryption keys.
- E. Correct.
Correct: AWS KMS supports automatic key rotation, and key policies allow you to define precise access controls, ensuring compliance with the security and administrative requirements.