SCS-C02 Question 408
Select 2Your organization uses AWS Key Management Service (KMS) to manage encryption keys for securing sensitive data. A developer needs to encrypt application configuration data using a Customer Master Key (CMK) managed in AWS KMS. The developer plans to use the Encrypt API to encrypt the data. As a security engineer, what must you ensure for the developer to successfully perform this operation?
- A
The developer must have the IAM permission kms:Encrypt for the specific CMK.
- B
The CMK must have been rotated at least once before it can be used for encryption.
- C
The developer must explicitly specify the encryption algorithm in the
EncryptAPI request. - D
The CMK must be in an enabled state.
Show answer and explanation
Correct answers: A, D
Explanation
To use the AWS KMS Encrypt API, two key conditions must be met: the IAM user or role must have the appropriate permissions (in this case, kms:Encrypt), and the CMK being used must be in an enabled state. Without these, the operation will fail. Key rotation and explicitly specifying the encryption algorithm are not mandatory for using the Encrypt API.
- A. Correct.
Correct. The kms:Encrypt IAM permission is required for the developer to use the
EncryptAPI to encrypt data with the CMK. - B. Incorrect.
Incorrect. CMK rotation is not required to use the key for encryption. A CMK can be used for encryption as long as it is in an enabled state and permissions are properly configured.
- C. Incorrect.
Incorrect. The
EncryptAPI automatically selects a default encryption algorithm if one is not explicitly specified. Specifying the algorithm is optional. - D. Correct.
Correct. The CMK must be in an enabled state to perform any cryptographic operations, including encryption.