A company is planning to implement a new SAP workload on SUSE Linux Enterprise Server on AWS. The company needs to use AWS Key Management Service (AWS KMS) to encrypt every file at rest. The company…

Question

Options

• ACreate an asymmetric KMS customer managed key in the production account. Create Amazon
• BCreate a symmetric KMS customer managed key in the production account. Create Amazon
• CCreate a symmetric KMS customer managed key in the production account. Create Amazon
• DCreate an asymmetric KMS customer managed key in the production account. Create Amazon

• A
  13% (7)
• B
  5% (3)
• C
  80% (45)
• D
  2% (1)

Explanation

Amazon EFS encryption at rest uses AES-256 symmetric encryption and therefore requires a symmetric KMS customer managed key (CMK) - asymmetric keys (Options A and D) are incompatible with EFS. A symmetric CMK created in the production account can have a key policy that grants cross-account access, allowing the non-production account to use the same EFS transport directory (/usr/sap/trans) over the existing VPC peering connection. Option B differs from C in the details of how the EFS resource policy or mount target is configured to allow cross-account access; Option C correctly combines symmetric key type with the appropriate cross-account EFS share configuration needed to satisfy both the encryption and shared transport directory requirements.

No community discussion yet for this question.