ExpertAWS SAP-C02 · Question 13 · Domain 1.2: Security Controls
A company requires strict data residency and encryption controls. They must use AWS KMS for encryption, but the key material must be generated and stored in an on-premises Hardware Security Module (HSM). Which TWO steps are required to implement this? (Select TWO)
A company requires strict data residency and encryption controls. They must use AWS KMS for encryption, but the key material must be generated and stored in an on-premises Hardware Security Module (HSM). Which TWO steps are required to implement this? (Select TWO)
Answer options:
Create a KMS key with no key material (external key store).
Use AWS CloudHSM to generate the key material and link it to KMS.
Establish a VPC Peering connection to the on-premises data center.
Download the public key and import token from KMS, encrypt the key material on-premises, and upload it to KMS.
Configure KMS to use AWS Direct Connect to fetch the key dynamically for every encryption request.
Enable S3 Server-Side Encryption with Customer-Provided Keys (SSE-C).
How to approach this question
Full Answer
Common mistakes
Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 2
75 questions · hints · full answers · grading