AWS - Certified Solutions Architect Data Encryption with KMS Questions and Answers

Question 1

An application needs to encrypt large objects (greater than 10 GB) on the client side before uploading them to Amazon S3.
The solution must use AWS KMS to manage the root keys.
What is the most secure and efficient method to accomplish this?

Accepted Answer

Use the KMS GenerateDataKey API to create a data key, use it to encrypt the object locally, and store the encrypted data key alongside the encrypted object in S3.

Answer

Send the entire 10 GB object to the KMS Encrypt API to be encrypted directly by the KMS key.

Answer

Create a new unique customer managed KMS key for each 10 GB object to ensure strong encryption boundaries.

Answer

Configure S3 server-side encryption with KMS-managed keys (SSE-KMS) and let S3 handle all encryption automatically upon upload.

Question 2

A solutions architect is troubleshooting an issue where an IAM role, which has an IAM policy granting `kms:Decrypt` permissions, is unable to decrypt an object from an S3 bucket encrypted with a customer managed KMS key. What is the most likely reason for this failure?

Accepted Answer

The KMS key policy does not grant the IAM role (or its AWS account) permissions to use the key.

Answer

The IAM policy must be attached to the EC2 instance profile, not the role itself.

Answer

The S3 bucket policy is explicitly denying the `s3:GetObject` action for the role.

Answer

The IAM role and the KMS key must be in the same AWS Region.

Question 3

Which of the following statements accurately describes a key difference between an AWS managed KMS key and a customer managed KMS key?

Accepted Answer

Customer managed keys offer full control over the key policy and key rotation schedule, whereas these are managed by AWS for AWS managed keys.

Answer

Only customer managed keys support envelope encryption.

Answer

AWS managed keys are provided free of charge, while customer managed keys incur a monthly fee.

Answer

AWS managed keys cannot be shared across different AWS accounts.

Question 4

A security team in Account A manages a central customer managed KMS key. A development team in Account B needs to launch EC2 instances with encrypted EBS volumes using this central key. What combination of policies is required to grant this cross-account access?

Accepted Answer

A key policy in Account A that grants usage permissions to Account B, and an IAM policy in Account B that allows the relevant IAM principals to use the key.

Answer

An IAM policy in Account B allowing `kms:CreateGrant` on the key's ARN, and no changes needed in Account A.

Answer

An S3 bucket policy in Account A that delegates KMS permissions to Account B.

Answer

A Service Control Policy (SCP) applied to the organization that allows `kms:*` between the two accounts.

Question 5

An administrator wants to permanently remove a customer managed KMS key that is no longer in use. What is the correct procedure for deleting a KMS key to prevent accidental data loss?

Accepted Answer

The administrator must schedule the key for deletion, which enforces a mandatory waiting period of 7 to 30 days before the key is permanently removed.

Answer

The administrator must first disable the key, which triggers an automatic deletion after 30 days.

Answer

The administrator can immediately and irrevocably delete the key using the AWS CLI with the `--force` flag.

Answer

The administrator must open a high-priority support case with AWS to request the key's deletion.

Question 6

In the context of envelope encryption with AWS KMS, what is the primary role of the customer managed key?

Accepted Answer

To encrypt and decrypt the data encryption key (DEK) that is used to encrypt the application data.

Answer

To directly encrypt and decrypt large volumes of application data.

Answer

To generate a digital signature for the encrypted data to ensure its integrity.

Answer

To be stored in the same S3 bucket as the encrypted data for easy retrieval.