SAP-C02 Question 61
Single answerA financial services company needs to implement a secure solution to encrypt sensitive customer data stored in Amazon S3. They also want to ensure that encryption keys are rotated automatically and managed centrally. Additionally, the solution must allow the company to import their own encryption keys, if needed, to meet compliance requirements. Which service or combination of services should the company use?
- A
AWS Key Management Service (AWS KMS) with Customer Master Keys (CMKs)
- B
AWS Certificate Manager (ACM)
- C
Amazon S3 Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
- D
AWS Secrets Manager
Show answer and explanation
Correct answer: A
Explanation
AWS Key Management Service (AWS KMS) is the best solution for this scenario because it meets all the company’s requirements: centralized and automated key management, support for key rotation, and the ability to import customer-provided keys. While other options like SSE-S3 or ACM provide encryption-related functionalities, they do not address the specific needs of managing keys centrally or importing keys for compliance.
- A. Correct.
AWS Key Management Service (AWS KMS) with Customer Master Keys (CMKs) is the correct choice because it provides a centralized solution for managing encryption keys, supports automatic key rotation, and allows importing of customer-provided keys (known as 'Bring Your Own Key' or BYOK). It integrates seamlessly with Amazon S3 to encrypt data.
- B. Incorrect.
AWS Certificate Manager (ACM) is used to manage SSL/TLS certificates for securing communication over HTTPS. It is not designed for encrypting data at rest or managing encryption keys for Amazon S3.
- C. Incorrect.
Amazon S3 Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3) provides encryption for S3 data, but it does not allow the customer to import their own keys or manage encryption keys centrally. Key management is fully handled by AWS, which does not meet the company’s compliance requirements.
- D. Incorrect.
AWS Secrets Manager is used to securely store, retrieve, and manage secrets such as database credentials or API keys. It is not intended for managing encryption keys for data encryption in services like Amazon S3.