A company is designing an application on AWS that processes sensitive data. The application stores and processes financial data for multiple customers. To meet compliance requirements, the data for…

Question

Options

• AGenerate a unique encryption key for each customer. Store the keys in an Amazon S3 bucket.
• BDeploy a hardware security appliance in the AWS environment that securely stores customer-
• CCreate a single AWS KMS key to encrypt all sensitive data across the application.
• DCreate separate AWS KMS keys for each customer's data that have granular access control and

• A
  7% (4)
• B
  4% (2)
• C
  11% (6)
• D
  79% (45)

Explanation

This solution meets the requirement of encrypting each customer's data separately with the least operational overhead by leveraging AWS Key Management Service (KMS). Separate AWS KMS Keys: By creating separate KMS keys for each customer, you can ensure that each customer's data is encrypted with a unique key. This approach satisfies the compliance requirement for separate encryption and provides fine-grained control over access to the keys. Granular Access Control: AWS KMS allows you to define key policies and use IAM policies to grant specific permissions to the keys. This ensures that only authorized users or services can access the keys, thereby maintaining the principle of least privilege. Logging and Monitoring: AWS KMS integrates with AWS CloudTrail, which logs all key usage and management activities. This provides an audit trail that is essential for meeting compliance Why Not Other Options? Option A (Store keys in S3): Storing keys in S3 is not recommended because it does not provide the same level of security, access control, or integration with AWS services as KMS does. Option B (Hardware security appliance): Deploying a hardware security appliance adds significant operational overhead and complexity, which is unnecessary given that KMS already provides a secure and centralized key management solution. Option C (Single KMS key for all data): Using a single KMS key does not meet the requirement of encrypting each customer's data separately.

No community discussion yet for this question.