DAS-C01 · Question #79
A company uses the Amazon Kinesis SDK to write data to Kinesis Data Streams. Compliance requirements state that the data must be encrypted at rest using a key that can be rotated. The company wants…
The correct answer is B. Create a customer master key (CMK) in AWS KMS. To meet compliance requirements for encrypted data at rest in Kinesis Data Streams with a rotatable key and minimal coding effort, the company should create a customer master key (CMK) in AWS KMS.
Question
A company uses the Amazon Kinesis SDK to write data to Kinesis Data Streams. Compliance requirements state that the data must be encrypted at rest using a key that can be rotated. The company wants to meet this encryption requirement with minimal coding effort. How can these requirements be met?
Options
- ACreate a customer master key (CMK) in AWS KMS.
- BCreate a customer master key (CMK) in AWS KMS.
- CCreate a customer master key (CMK) in AWS KMS.
- DEnable server-side encryption on the Kinesis data stream using the default KMS key for Kinesis
How the community answered
(54 responses)- A9% (5)
- B81% (44)
- C6% (3)
- D4% (2)
Why each option
To meet compliance requirements for encrypted data at rest in Kinesis Data Streams with a rotatable key and minimal coding effort, the company should create a customer master key (CMK) in AWS KMS.
Creating a customer master key (CMK) in AWS KMS allows the company to manage their own encryption key, including its rotation policy, which satisfies compliance for a rotatable key. Configuring Kinesis Data Streams for server-side encryption using this CMK requires no application code changes, ensuring minimal coding effort.
Enabling server-side encryption using the default KMS key for Kinesis uses an AWS-managed key, which is rotated by AWS but does not provide the customer control over the key or its rotation policy, potentially not meeting specific compliance interpretations for a 'key that can be rotated' under customer management.
Concept tested: Kinesis Data Streams encryption with customer-managed keys
Source: https://docs.aws.amazon.com/kinesis/latest/dev/sse-config.html
Topics
Community Discussion
No community discussion yet for this question.