Data Protection

1. A security architect needs to encrypt large datasets in S3 using AWS KMS. The design must minimize calls to KMS and avoid sending large payloads to the KMS API. Which envelope encryption approach is correct?

• A.Generate a data key via KMS, use it locally to encrypt the data, then store only the encrypted data key alongside the ciphertext — not the plaintext data key.✓ Correct
• B.Send the entire dataset directly to AWS KMS for encryption using the Customer Master Key, which can handle payloads of any size.
• C.Use the Customer Master Key to encrypt the data key and also encrypt the data directly, storing both encrypted objects in S3.
• D.Store the plaintext data key in AWS Secrets Manager alongside the encrypted data so it can be retrieved for decryption at any time.

2. During decryption, an application retrieves an encrypted data key stored alongside a ciphertext blob in S3. What is the correct next step to decrypt the data?

• A.Call KMS Decrypt with the encrypted data key to retrieve the plaintext data key, then use it to decrypt the ciphertext locally in memory.✓ Correct
• B.Call KMS GenerateDataKey again to create a new plaintext data key, which will automatically match the original key used for encryption.
• C.Pass the encrypted ciphertext blob directly to KMS Decrypt, which will identify the correct CMK and return the plaintext data.
• D.Use AWS Secrets Manager to look up the original plaintext data key that was stored at encryption time, then apply it to the ciphertext.

3. A team is building a containerized microservice that encrypts data and passes the encrypted data key to a separate decryption service. The encryption container should never hold a plaintext key in memory. Which KMS API call should the encryption container use?

• A.Call GenerateDataKeyWithoutPlaintext to receive only the encrypted data key, deferring all plaintext key handling to the authorized decryption service.✓ Correct
• B.Call GenerateDataKey to get both the plaintext and encrypted data key, then immediately delete the plaintext key variable after use.
• C.Call CreateKey to generate a new CMK for each container instance and use it directly to encrypt data without creating a data key.
• D.Call Encrypt with the raw data payload to use the CMK directly, avoiding the need for any data key generation in the container.

4. In a distributed pipeline, Worker A encrypts data using GenerateDataKeyWithoutPlaintext and stores the encrypted data key alongside the ciphertext. Worker B must decrypt the data later. What must Worker B have to successfully decrypt?

• A.Worker B needs KMS Decrypt permission on the CMK used by Worker A to unwrap the encrypted data key and obtain the plaintext key for decryption.✓ Correct
• B.Worker B must regenerate the data key using GenerateDataKey with the same CMK, which will reproduce an identical key for decryption.
• C.Worker B needs access to the S3 bucket containing the ciphertext but does not require any KMS permissions because the data key handles decryption.
• D.Worker B must have the same IAM role as Worker A so that KMS will recognize it as the original encryptor and return the plaintext key automatically.

5. A compliance officer requires full audit trails of all KMS key usage, the ability to set custom key rotation schedules, and the option to disable keys immediately if a breach is detected. Which CMK type meets all these requirements?

• A.Customer managed CMKs, which provide full control over key policies, rotation schedules, enabling/disabling, and detailed CloudTrail logging of every API call.✓ Correct
• B.AWS managed CMKs, which are automatically created by AWS services and allow customers to set custom rotation policies and disable keys on demand.
• C.AWS owned CMKs, which are managed entirely by AWS and provide the highest level of customer visibility through AWS Config and CloudTrail.
• D.AWS managed CMKs, which give customers complete key policy control and allow immediate key deletion with a configurable waiting period of 0 days.