ExpertHard1 markMultiple Choice
AWS SAA-C03 · Question 06 · Domain 1.3: Data Security
A financial company requires that all data stored in Amazon S3 is encrypted at rest using keys managed by the company. The keys must be rotated automatically every year. Which TWO actions should the solutions architect take? (Select TWO.)
A financial company requires that all data stored in Amazon S3 is encrypted at rest using keys managed by the company. The keys must be rotated automatically every year. Which TWO actions should the solutions architect take? (Select TWO.)
Answer options:
A.
Use SSE-S3 (Amazon S3 managed keys).
B.
Create a customer managed KMS key.
C.
Use an AWS managed KMS key (aws/s3).
D.
Enable automatic key rotation for the KMS key.
E.
Store the encryption keys in AWS Secrets Manager and configure a Lambda function for rotation.
How to approach this question
Identify the need for customer control over keys and the native KMS rotation feature.
Full Answer
Create a customer managed KMS key., Enable automatic key rotation for the KMS key.
Customer managed KMS keys allow you to enable automatic key rotation, which generates new cryptographic material every year (365 days) while keeping the same key ID.
Common mistakes
Selecting AWS managed keys, which rotate every 3 years, not 1 year.
Practice the full AWS SAA-C03 Practice Exam 5
65 questions · hints · full answers · grading
More questions from this exam
Q01A company needs to grant an external auditor read-only access to specific AWS resources. The audi...EasyQ02An application running on EC2 instances needs to access objects in an S3 bucket. The security tea...MediumQ03A company is designing a VPC for a multi-tier web application. They need to block specific malici...MediumQ04A large enterprise uses AWS Organizations to manage multiple accounts. The security team wants to...HardQ05A company hosts a web application on an Application Load Balancer (ALB). They are experiencing SQ...Medium