A banking company is currently using an Amazon Redshift cluster with dense storage (DS) nodes to store sensitive data. An audit found that the cluster is unencrypted. Compliance requirements state…

Question

Options

• ASet up a trusted connection with HSM using a client and server certificate with automatic key
• BModify the cluster with an HSM encryption option and automatic key rotation.
• CCreate a new HSM-encrypted Amazon Redshift cluster and migrate the data to the new cluster.
• DEnable HSM with key rotation through the AWS CLI.
• EEnable Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) encryption in the HSM.

• A
  63% (34)
• B
  19% (10)
• D
  7% (4)
• E
  11% (6)

Explanation

Amazon Redshift does not support enabling encryption on an existing unencrypted cluster in place - the cluster must be recreated. Therefore two steps are required: (A) Establish the trusted HSM connection by configuring client and server certificates between Redshift and the HSM appliance, with automatic key rotation enabled to meet compliance; and (C) Create a new Redshift cluster configured with HSM encryption, then migrate all data from the old unencrypted cluster to the new one. Option B is incorrect because you cannot simply 'modify' an existing cluster to enable HSM encryption - a new cluster is required. Option D is incorrect because HSM integration is not something that can be enabled via AWS CLI alone without the certificate trust setup. Option E (ECDHE) is a TLS cipher suite for in-transit encryption, not at-rest HSM key management.

No community discussion yet for this question.