SCS-C02 Question 112
Single answerYour organization is migrating sensitive workloads to AWS and requires a solution to generate, manage, and rotate encryption keys securely. The compliance team has mandated that no AWS personnel should be able to access your encryption keys. Which AWS service or feature satisfies these requirements?
- A
AWS Key Management Service with AWS managed keys
- B
AWS Key Management Service with customer-managed keys and key material generated by AWS
- C
AWS Key Management Service with customer-managed keys and imported key material
- D
AWS Secrets Manager
Show answer and explanation
Correct answer: C
Explanation
To meet the compliance requirement that AWS personnel should not be able to access encryption keys, you must use AWS KMS with customer-managed keys and import your own key material. This ensures that only your organization has control over the key material, and it adheres to compliance and security mandates.
- A. Incorrect.
AWS KMS with AWS managed keys does not meet the compliance requirement because AWS manages the keys, and AWS personnel could potentially access them.
- B. Incorrect.
While AWS KMS with customer-managed keys allows more control over the keys, key material generated by AWS could still be accessed by AWS personnel, which does not meet the compliance requirement.
- C. Correct.
AWS KMS with customer-managed keys and imported key material meets the compliance requirement because you generate and import your own key material, ensuring that AWS personnel do not have access to it.
- D. Incorrect.
AWS Secrets Manager is used for managing secrets like database credentials or API keys, not for managing encryption keys, so it does not meet the requirements.