SCS-C02 · Question #395
A company continually generates sensitive records that it stores in an S3 bucket. All objects in the bucket are encrypted using SSE-KMS using one of the company's CMKs. Company compliance policies…
The correct answer is A. Trigger a Lambda function with a monthly CloudWatch event that creates a new CMK and. You can use a Lambda function to create a new key and then update the S3 bucket to use the Remember not to delete the old key, else you will not be able to decrypt the documents stored in the S3 bucket using the older key. Option B is incorrect because AWS KMS cannot rotate…
Question
A company continually generates sensitive records that it stores in an S3 bucket. All objects in the bucket are encrypted using SSE-KMS using one of the company's CMKs. Company compliance policies require that no more than one month of data be encrypted using the same encryption key. What solution below will meet the company's requirements?
Options
- ATrigger a Lambda function with a monthly CloudWatch event that creates a new CMK and
- BConfigure the CMK to rotate the key material every month.
- CTrigger a Lambda function with a monthly CloudWatch event that creates a new CMK, updates
- DTrigger a Lambda function with a monthly CloudWatch event that rotates the key material in the
How the community answered
(28 responses)- A71% (20)
- B7% (2)
- C18% (5)
- D4% (1)
Explanation
You can use a Lambda function to create a new key and then update the S3 bucket to use the Remember not to delete the old key, else you will not be able to decrypt the documents stored in the S3 bucket using the older key. Option B is incorrect because AWS KMS cannot rotate keys on a monthly basis Option C is incorrect because deleting the old key means that you cannot access the older Option D is incorrect because rotating key material is not possible. https://docs.aws.amazon.com/kms/latest/developereuide/concepts.html
Topics
Community Discussion
No community discussion yet for this question.