A company wants to have a secure way of generating, storing and managing cryptographic exclusive access for the keys. Which of the following can be used for this purpose?

Question

Options

• AUse KMS and the normal KMS encryption keys
• BUse KMS and use an external key material
• CUse S3 Server Side encryption
• DUse Cloud HSM

• A
  6% (3)
• B
  4% (2)
• C
  17% (8)
• D
  73% (35)

Explanation

The AWS Documentation mentions the following The AWS CloudHSM service helps you meet corporate, contractual and regulatory compliance requirements for data security by using dedicated Hardware Security Module (HSM) instances within the AWS cloud. AWS and AWS Marketplace partners offer a variety of solutions for protecting sensitive data within the AWS platform, but for some applications and data subject to contractual or regulatory mandates for managing cryptographic keys, additional protection may be necessary. CloudHSM complements existing data protection solutions and allows you to protect your encryption keys within HSMs that are desigr and validated to government standards for secure key management. CloudHSM allows you to securely generate, store and manage cryptographic keys used for data encryption in a way that keys are accessible only by you. Option A.B and Care invalid because in all of these cases, the management of the key will be with AWS. Here the question specifically mentions that you want to have exclusive access over the keys. This can be achieved with Cloud HSM. https://aws.amazon.com/cloudhsm/faq:

No community discussion yet for this question.