SAP-C02 Question 62
Select 2Your company is building a secure financial application that must store sensitive customer data, such as personally identifiable information (PII). The application requires encryption for data at rest, and you must use a compliant key management solution. Additionally, the application uses HTTPS for secure communication between clients and the backend API and needs automatic certificate renewal to reduce operational overhead. Which combination of AWS services should you use to meet these requirements?
- A
AWS Key Management Service (AWS KMS) for managing encryption keys and AWS Certificate Manager (ACM) for managing SSL/TLS certificates
- B
AWS Secrets Manager for managing encryption keys and AWS Certificate Manager (ACM) for managing SSL/TLS certificates
- C
AWS Key Management Service (AWS KMS) for managing encryption keys and Amazon S3 for hosting SSL/TLS certificates
- D
AWS CloudHSM for managing encryption keys and manually uploading SSL/TLS certificates to Amazon EC2 instances
- E
AWS Key Management Service (AWS KMS) for managing encryption keys and AWS CloudFront with an ACM-managed certificate for HTTPS
Show answer and explanation
Correct answers: A, E
Explanation
AWS Key Management Service (AWS KMS) is an optimal choice for managing encryption keys in a compliant manner for data at rest. AWS Certificate Manager (ACM) simplifies the process of managing SSL/TLS certificates by automating renewals, which reduces operational overhead. Additionally, integrating ACM with services like AWS CloudFront enables secure content delivery over HTTPS. Combining AWS KMS with ACM ensures both encryption and secure communication requirements are met effectively.
- A. Correct.
AWS Key Management Service (AWS KMS) is a fully managed service that enables you to create and control encryption keys for data at rest. AWS Certificate Manager (ACM) provides SSL/TLS certificates and supports automatic certificate renewal, making it a good fit for secure HTTPS communication.
- B. Incorrect.
AWS Secrets Manager is designed for managing secrets such as database credentials, not encryption keys. While AWS Certificate Manager (ACM) is suitable for managing SSL/TLS certificates, Secrets Manager does not address the requirement for compliant encryption key management.
- C. Incorrect.
AWS KMS is suitable for managing encryption keys. However, Amazon S3 is not used for managing SSL/TLS certificates. SSL/TLS certificates should be managed using a service like ACM for automated renewals and secure distribution.
- D. Incorrect.
AWS CloudHSM provides hardware-based encryption key management, but it requires manual effort and is more complex to manage compared to AWS KMS. Manually uploading SSL/TLS certificates to EC2 instances introduces operational overhead and does not meet the requirement for automatic certificate renewal.
- E. Correct.
AWS KMS is a compliant key management solution for encryption keys. Using AWS CloudFront with an ACM-managed certificate for HTTPS allows you to distribute secure content with SSL/TLS and benefit from automatic certificate renewal.