A company stores training data as a .csv file in an Amazon S3 bucket. The company must encrypt the data and must control which applications have access to the encryption key. Which solution will meet

Question

Options

• ACreate a new SSH access key. Use the AWS Encryption CLI with a reference to the new access
• BCreate a new API key by using the Amazon API Gateway CreateApiKey API operation. Use the
• CCreate a new IAM role. Attach a policy that allows the AWS Key Management Service (AWS
• DCreate a new AWS Key Management Service (AWS KMS) key. Use the AWS Encryption CLI with

• A
  5% (3)
• B
  2% (1)
• C
  13% (7)
• D
  80% (44)

Explanation

Option D is correct because AWS KMS is the purpose-built service for creating and controlling encryption keys, and the AWS Encryption CLI integrates directly with KMS to encrypt data while enforcing IAM-based access policies that determine which applications can use the key. This gives the company cryptographic control over who can decrypt the training data stored in S3.

Why the distractors fail:

• A - SSH keys are for server authentication (EC2, Git), not data encryption. They have no integration with S3 data encryption workflows.
• B - API Gateway API keys are for controlling access to API endpoints, not for encrypting data or managing cryptographic keys.
• C - Creating an IAM role alone doesn't create an encryption key or encrypt anything; you still need KMS to generate and manage the actual key material.

Memory tip: When a question mentions "control which applications have access to the encryption key," think KMS key policies + IAM - that combination is the only AWS-native way to grant or deny key usage per application. The phrase "control the key" = KMS.

No community discussion yet for this question.