SCS-C02 · Question #287
A company wants to encrypt data locally while meeting regulatory requirements related to key exhaustion. The encryption key can be no more than 10 days old or encrypt more than 2^16 objects. Any…
The correct answer is A. Use the AWS Encryption SDK and set the maximum age to 10 days and the maximum number of. Caching can reduce your use of cryptographic services, such as AWS Key Management Service (AWS KMS). If you are hitting your AWS KMS requests-per-second limit, caching can help. Your application can use cached keys to service some of your data key requests instead of calling…
Question
A company wants to encrypt data locally while meeting regulatory requirements related to key exhaustion. The encryption key can be no more than 10 days old or encrypt more than 2^16 objects. Any encryption key must be generated on a FIPS-validated hardware security module (HSM). The company is cost- conscious, as it plans to upload an average of 100 objects to Amazon S3 each second for sustained operations across 5 data producers. Which approach MOST efficiently meets the company's needs?
Options
- AUse the AWS Encryption SDK and set the maximum age to 10 days and the maximum number of
- BUse AWS Key Management Service (AWS KMS) to generate an AWS managed CMK.
- CUse AWS CloudHSM to generate the master key and data keys.
- DUse server-side encryption with Amazon S3 managed encryption keys (SSE-S3) and set the
How the community answered
(28 responses)- A82% (23)
- B4% (1)
- C11% (3)
- D4% (1)
Explanation
Caching can reduce your use of cryptographic services, such as AWS Key Management Service (AWS KMS). If you are hitting your AWS KMS requests-per-second limit, caching can help. Your application can use cached keys to service some of your data key requests instead of calling https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/data-key-caching.html
Topics
Community Discussion
No community discussion yet for this question.