SCS-C02 Question 410
Select 3Your organization is using AWS Key Management Service (KMS) to manage encryption keys for sensitive data. You have been asked to configure a new symmetric encryption key for use in an application that will encrypt and decrypt data at high volumes. Additionally, the application must ensure that only authorized IAM users can access the key and perform encryption and decryption operations. Which steps should you take to meet these requirements?
- A
Create a symmetric customer-managed key (CMK) in AWS KMS and define a key policy to grant specific IAM users access to the key.
- B
Generate a data key using the symmetric CMK and store the plaintext key in the application for encryption and decryption.
- C
Use the AWS KMS Encrypt and Decrypt APIs to perform encryption and decryption with the symmetric CMK, ensuring only authorized IAM users have access.
- D
Create an asymmetric CMK in AWS KMS for encryption and decryption as it provides better performance for high-volume operations.
- E
Enable automatic key rotation for the symmetric CMK to ensure compliance with security best practices.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet the requirements, you should use a symmetric customer-managed key (CMK) in AWS KMS, as symmetric keys are optimized for high-volume encryption and decryption. Key policies should be defined to limit access to authorized IAM users. AWS KMS Encrypt and Decrypt APIs ensure secure operations and auditability. Enabling automatic key rotation adheres to security best practices by ensuring key material is regularly refreshed. Avoid storing plaintext keys in the application, as this risks exposure of sensitive data.
- A. Correct.
Correct: Creating a symmetric customer-managed key (CMK) allows you to control access via key policies, which can explicitly define which IAM users or roles can use the key for encryption and decryption.
- B. Incorrect.
Incorrect: Storing the plaintext data key in the application is not a secure practice and violates AWS best practices. Instead, use AWS KMS APIs to handle encryption and decryption securely.
- C. Correct.
Correct: Using AWS KMS Encrypt and Decrypt APIs leverages AWS KMS to securely perform encryption and decryption, ensuring that operations are logged in CloudTrail and restricted to authorized users.
- D. Incorrect.
Incorrect: Asymmetric CMKs are designed for specific use cases such as digital signatures or public-private key encryption. For high-volume symmetric encryption and decryption, symmetric CMKs are more efficient.
- E. Correct.
Correct: Enabling automatic key rotation ensures that the key material is periodically replaced, which is a security best practice and helps maintain compliance with organizational or regulatory requirements.