SCS-C02 Question 411
Single answerYour organization uses AWS Key Management Service (KMS) to secure sensitive data. You need to encrypt a large file (300 MB) using a symmetric key stored in KMS. What is the most efficient and secure method to achieve this?
- A
Encrypt the file directly using the AWS KMS symmetric key by calling the Encrypt API.
- B
Use the GenerateDataKey API to obtain a data encryption key (DEK), use it to encrypt the file, and then encrypt the DEK with the AWS KMS symmetric key.
- C
Use the AWS KMS asymmetric key to encrypt the file directly.
- D
Split the file into smaller chunks and encrypt each chunk directly using the AWS KMS symmetric key.
Show answer and explanation
Correct answer: B
Explanation
Encrypting large files directly with AWS KMS symmetric keys is inefficient and limited to 4 KB of data per API call. The recommended approach is to use the GenerateDataKey API to create a data encryption key (DEK). The DEK can be used locally to encrypt the file, and then the DEK itself is encrypted with the symmetric key stored in KMS for secure storage. This ensures both security and optimal performance.
- A. Incorrect.
Encrypting large files directly using the AWS KMS symmetric key is inefficient and not recommended. The KMS Encrypt API is designed for small amounts of data (up to 4 KB).
- B. Correct.
This is the correct approach. The GenerateDataKey API creates a data encryption key (DEK) that can be used to encrypt large files efficiently. The DEK is encrypted with the AWS KMS symmetric key for secure storage.
- C. Incorrect.
Asymmetric keys in AWS KMS are not suitable for encrypting large files directly due to performance limitations. They are typically used for smaller data or encrypting keys.
- D. Incorrect.
Splitting the file and encrypting each chunk directly with KMS is inefficient and still limited by the 4 KB restriction of the Encrypt API.