A company needs to use an AWS Transfer Family SFTP-enabled server with an Amazon S3 bucket to receive updates from a third-party data supplier. The data is encrypted with Pretty Good Privacy (PGP) enc

Question

Options

• AStore the PGP public key in Secrets Manager. Add a nominal step in the Transfer Family
• BStore the PGP private key in Secrets Manager. Add an exception-handling step in the Transfer
• CStore the PGP private key in Secrets Manager. Add a nominal step in the Transfer Family
• DStore the PGP public key in Secrets Manager. Add an exception-handling step in the Transfer

• A
  7% (4)
• B
  14% (8)
• C
  75% (42)
• D
  4% (2)

Explanation

Option C is correct because PGP decryption requires the private key - the company is the recipient, so it holds the private key to unlock data that the third party encrypted using the company's public key. The private key must be stored securely in Secrets Manager so the Transfer Family workflow can retrieve it at runtime. The decryption logic belongs in a nominal step, which represents standard in-line processing in a managed workflow, not error handling.

Why the distractors fail:

• A & D store the public key - public keys encrypt data, they cannot decrypt it; using one here would make decryption impossible.
• B uses the correct private key but places decryption in an exception-handling step, which only triggers on workflow errors - decryption is a normal processing action, not a fault response.

Memory tip: Think "private = personal = yours to keep." You share your public key so others can lock (encrypt) data for you, and you use your private key to unlock (decrypt) it. On the exam, any scenario involving receiving and decrypting always means the private key is in play.

No community discussion yet for this question.