A company uses Amazon EC2 instances and stores data on Amazon Elastic Block Store (Amazon EBS) volumes. The company must ensure that all data is encrypted at rest by using AWS Key Management Service (

Question

Options

• ACreate a customer managed key Use the key to encrypt the EBS volumes.
• BUse an AWS managed key to encrypt the EBS volumes. Use the key to configure automatic key
• CCreate an external KMS key with imported key material. Use the key to encrypt the EBS volumes.
• DUse an AWS owned key to encrypt the EBS volumes.

• A
  73% (30)
• B
  15% (6)
• C
  10% (4)
• D
  2% (1)

Explanation

To meet the requirement of controlling key rotation with minimal operational overhead, creating acustomer managed key(CMK) in AWS KMS is the optimal solution. With CMKs, you can define custom key rotation policies, ensuring that you retain control over the key lifecycle, including enabling automatic key rotation every year. Key AWS features: Custom Key Management: A customer managed key allows you to control the key policies, lifecycle, and enable key rotation for compliance. Least Operational Overhead: Using a customer managed key simplifies encryption management while offering more flexibility than AWS managed or owned keys. AWS Documentation: The AWS Well-Architected Framework recommends customer managed keys for environments where key control and flexibility are required.

No community discussion yet for this question.