SOA-C02 Question 208
Select 3An organization is using AWS Key Management Service (KMS) to encrypt sensitive data in their application. They want to ensure that their Customer Managed Keys (CMKs) are rotated automatically every year and that unauthorized users cannot access the keys. What steps should the SysOps Administrator take to meet these requirements?
- A
Enable automatic key rotation for the CMKs in the KMS console.
- B
Manually rotate the CMKs every year using the AWS CLI.
- C
Apply a key policy that restricts access to only authorized IAM users and roles.
- D
Disable automatic key rotation and depend on AWS-managed keys for rotation.
- E
Enable AWS CloudTrail to log KMS API calls for auditing purposes.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet the requirements, the SysOps Administrator should enable automatic key rotation for the CMKs to ensure annual rotation, apply a key policy that limits access to authorized users, and enable AWS CloudTrail to log and monitor KMS API calls. These measures collectively enhance the security and manageability of the encryption keys.
- A. Correct.
Correct. Enabling automatic key rotation ensures that the CMK is rotated every year, which is a recommended best practice for security.
- B. Incorrect.
Incorrect. While it is possible to manually rotate keys, it is not necessary when automatic key rotation is enabled.
- C. Correct.
Correct. A restrictive key policy ensures that only authorized IAM users and roles can access the CMKs, improving security.
- D. Incorrect.
Incorrect. Disabling automatic key rotation is not recommended for Customer Managed Keys, and AWS-managed keys are not suitable for this scenario as the organization is managing the keys themselves.
- E. Correct.
Correct. Enabling AWS CloudTrail provides visibility into KMS API calls, which helps in monitoring and auditing key usage and access.