SAA-C03 · Question #655
A home security company is expanding its business globally. The company needs to encrypt customer data. The company does not want to manage its own keys. The company needs the keys to be usable in mul
The correct answer is A. Use AWS Key Management Service (AWS KMS) to create multi-Region keys. Apply tags to. AWS KMS multi-Region keys are designed exactly for this use case: the same logical key can be replicated and used in multiple Regions, while AWS manages the underlying key infrastructure. You can control access with IAM policies using ABAC (tags and condition keys) and avoid mana
Question
A home security company is expanding its business globally. The company needs to encrypt customer data. The company does not want to manage its own keys. The company needs the keys to be usable in multiple AWS Regions and needs to control access to the keys. Which solution will meet these requirements with the LEAST operational overhead?
Options
- AUse AWS Key Management Service (AWS KMS) to create multi-Region keys. Apply tags to
- BUse AWS Key Management Service (AWS KMS) to create multiple keys by importing key
- CUse AWS CloudHSM to create a CloudHSM cluster in the company's primary Region.
- DUse AWS CloudHSM to create users. Use the CloudHSM Management Utility (CMU) to share
How the community answered
(33 responses)- A73% (24)
- B6% (2)
- C15% (5)
- D6% (2)
Explanation
AWS KMS multi-Region keys are designed exactly for this use case: the same logical key can be replicated and used in multiple Regions, while AWS manages the underlying key infrastructure. You can control access with IAM policies using ABAC (tags and condition keys) and avoid managing key material, clustering, or cross-Region synchronization yourself, giving you global encryption with the least operational overhead.
Community Discussion
No community discussion yet for this question.