nerdexam
Amazon

DAS-C01 · Question #79

A company uses the Amazon Kinesis SDK to write data to Kinesis Data Streams. Compliance requirements state that the data must be encrypted at rest using a key that can be rotated. The company wants…

The correct answer is B. Create a customer master key (CMK) in AWS KMS. To meet compliance requirements for encrypted data at rest in Kinesis Data Streams with a rotatable key and minimal coding effort, the company should create a customer master key (CMK) in AWS KMS.

Security

Question

A company uses the Amazon Kinesis SDK to write data to Kinesis Data Streams. Compliance requirements state that the data must be encrypted at rest using a key that can be rotated. The company wants to meet this encryption requirement with minimal coding effort. How can these requirements be met?

Options

  • ACreate a customer master key (CMK) in AWS KMS.
  • BCreate a customer master key (CMK) in AWS KMS.
  • CCreate a customer master key (CMK) in AWS KMS.
  • DEnable server-side encryption on the Kinesis data stream using the default KMS key for Kinesis

How the community answered

(54 responses)
  • A
    9% (5)
  • B
    81% (44)
  • C
    6% (3)
  • D
    4% (2)

Why each option

To meet compliance requirements for encrypted data at rest in Kinesis Data Streams with a rotatable key and minimal coding effort, the company should create a customer master key (CMK) in AWS KMS.

ACreate a customer master key (CMK) in AWS KMS.
BCreate a customer master key (CMK) in AWS KMS.Correct

Creating a customer master key (CMK) in AWS KMS allows the company to manage their own encryption key, including its rotation policy, which satisfies compliance for a rotatable key. Configuring Kinesis Data Streams for server-side encryption using this CMK requires no application code changes, ensuring minimal coding effort.

CCreate a customer master key (CMK) in AWS KMS.
DEnable server-side encryption on the Kinesis data stream using the default KMS key for Kinesis

Enabling server-side encryption using the default KMS key for Kinesis uses an AWS-managed key, which is rotated by AWS but does not provide the customer control over the key or its rotation policy, potentially not meeting specific compliance interpretations for a 'key that can be rotated' under customer management.

Concept tested: Kinesis Data Streams encryption with customer-managed keys

Source: https://docs.aws.amazon.com/kinesis/latest/dev/sse-config.html

Topics

#Kinesis Data Streams#AWS KMS#Server-Side Encryption#Key Rotation

Community Discussion

No community discussion yet for this question.

Full DAS-C01 Practice