DVA-C02 · Question #56
A company must encrypt sensitive data that the company will store in Amazon S3. A developer must retain total control over the company's AWS Key Management Service (AWS KMS) key and the company's…
The correct answer is D. Implement server-side encryption with AWS KMS managed keys (SSE-KMS). Use the AWS KMS. https://docs.aws.amazon.com/cloudhsm/latest/userguide/best-practices.html Q: Can other AWS services use CloudHSM to store and manage keys? AWS services integrate with AWS Key Management Service, which in turn is integrated with AWS CloudHSM through the KMS custom key store…
Question
A company must encrypt sensitive data that the company will store in Amazon S3. A developer must retain total control over the company's AWS Key Management Service (AWS KMS) key and the company's data keys. The company currently uses an on-premises hardware security module (HSM) solution. The company wants to move its key management onto AWS. Which solution will meet these requirements?
Options
- AImplement server-side encryption with AWS KMS managed keys (SSE-KMS). Use AWS
- BImplement server-side encryption with customer-provided encryption keys (SSE-C). Use AWS
- CImplement server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use
- DImplement server-side encryption with AWS KMS managed keys (SSE-KMS). Use the AWS KMS
How the community answered
(66 responses)- A5% (3)
- B12% (8)
- C23% (15)
- D61% (40)
Explanation
https://docs.aws.amazon.com/cloudhsm/latest/userguide/best-practices.html Q: Can other AWS services use CloudHSM to store and manage keys? AWS services integrate with AWS Key Management Service, which in turn is integrated with AWS CloudHSM through the KMS custom key store feature. If you want to use the server-side encryption offered by many AWS services (such as EBS, S3, or Amazon RDS), you can do so by configuring a custom key store in AWS KMS.
Community Discussion
No community discussion yet for this question.