SAP-C02 · Question #135
A company has multiple business units. Each business unit has its own AWS account and runs a single website within that account. The company also has a single logging account. Logs from each…
The correct answer is B. Create a customer managed CMK in the logging account. A - Incorrect - Manual Roation of key is not good B - Correct - Use a customer managed CMK if you want to grant cross-account access to your S3 objects. You can configure the policy of a customer managed CMK to allow access from another…
Question
A company has multiple business units. Each business unit has its own AWS account and runs a single website within that account. The company also has a single logging account. Logs from each business unit website are aggregated into a single Amazon S3 bucket in the logging account. The S3 bucket policy provides each business unit with access to write data into the bucket and requires data to be encrypted. The company needs to encrypt logs uploaded into the bucket using a single AWS Key Management Service (AWS KMS) CMK. The CMK that protects the data must be rotated once every 365 days. Which strategy is the MOST operationally efficient for the company to use to meet these requirements?
Options
- ACreate a customer managed CMK in the logging account
- BCreate a customer managed CMK in the logging account
- CUse an AWS managed CMK m the togging account
- DUse an AWS managed CMK in the togging account
How the community answered
(19 responses)- A5% (1)
- B79% (15)
- C5% (1)
- D11% (2)
Explanation
A - Incorrect - Manual Roation of key is not good B - Correct - Use a customer managed CMK if you want to grant cross-account access to your S3 objects. You can configure the policy of a customer managed CMK to allow access from another https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external- C,D - Incorrect. you cannot manage Amazon managed CMKs, rotate them, or change their key policies. AWS managed customer master key (CMK) key policies can't be modified because they're read-only.
Community Discussion
No community discussion yet for this question.