SCS-C02 Question 188
Single answerYour company is hosting a mission-critical application on Amazon EC2 instances within a single AWS region. To meet compliance requirements, the application must encrypt all sensitive data at rest and ensure only authorized personnel can access the encryption keys. The compliance team has also specified that keys must be rotated automatically every year. Which solution should you implement to meet these requirements?
- A
Use AWS Key Management Service (KMS) with customer-managed keys and enable automatic key rotation.
- B
Use AWS Secrets Manager to store sensitive data and enable automatic secret rotation.
- C
Use AWS Certificate Manager (ACM) to manage the encryption keys and enable automatic renewal.
- D
Use server-side encryption (SSE) with Amazon S3-managed keys (SSE-S3) to encrypt sensitive data.
Show answer and explanation
Correct answer: A
Explanation
AWS KMS with customer-managed keys is the most appropriate solution for encrypting sensitive data at rest while meeting the compliance requirement for automatic key rotation. KMS provides strong encryption and access control features, and customer-managed keys allow fine-grained permissions and automated rotation. Other options either do not support encryption at rest or do not meet the compliance requirements outlined in the scenario.
- A. Correct.
This is the correct solution. AWS KMS provides a secure way to create and manage encryption keys, and customer-managed keys allow you to control access. Enabling automatic key rotation meets the requirement for yearly key rotation.
- B. Incorrect.
AWS Secrets Manager is used for managing secrets like database credentials, API keys, and token storage. It is not designed for encrypting data at rest or rotating encryption keys.
- C. Incorrect.
AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates for securing network communications, not for managing encryption keys for data at rest.
- D. Incorrect.
SSE-S3 automatically encrypts data stored in Amazon S3 using S3-managed keys. However, it does not allow for customer control over key rotation or meet the requirement for using customer-managed keys.