AWS Certified Solutions Architect Data Encryption with KMS 2

Question 1

A company wants to encrypt S3 objects so that only specific IAM roles can decrypt them, even if someone gains S3 bucket access. Which KMS feature best satisfies this requirement?

Accepted Answer

SSE-KMS with a customer managed key and a restrictive key policy

Answer

S3 default encryption with SSE-S3

Answer

S3 Object Lock in compliance mode

Answer

SSE-C with a client-provided key

Question 2

Which KMS key type allows you to import your own key material generated outside of AWS?

Accepted Answer

Customer managed key with imported key material

Answer

AWS managed key

Answer

AWS owned key

Answer

Data key

Question 3

An architect needs to encrypt data at rest in RDS using KMS. What happens to the automated backups when the RDS instance uses KMS encryption?

Accepted Answer

Backups are encrypted with the same KMS key as the RDS instance

Answer

Backups are stored unencrypted to reduce cost

Answer

Backups use a separate AWS managed key automatically

Answer

Backups must be encrypted manually after creation

Question 4

A Lambda function needs to decrypt a secret stored in AWS Secrets Manager. The secret is encrypted with a customer managed KMS key. What permission must the Lambda execution role have?

Accepted Answer

kms:Decrypt and secretsmanager:GetSecretValue

Answer

secretsmanager:GetSecretValue only

Answer

kms:GenerateDataKey only

Answer

iam:PassRole on the KMS key

Question 5

What is the maximum size of data that can be encrypted directly using a KMS CMK via the Encrypt API call?

Accepted Answer

4 KB

Answer

1 MB

Answer

256 KB

Answer

64 KB

Question 6

A solutions architect wants to ensure that a KMS key is never used for encryption after a specific date. Which approach is most appropriate?

Accepted Answer

Disable the KMS key on the target date

Answer

Delete the KMS key immediately

Answer

Set the key's key policy to deny all actions after the date using a Condition

Answer

Rotate the key and discard the old version

Question 7

When using SSE-KMS to encrypt an S3 object, which API call does S3 make to KMS on behalf of the requester during a PutObject operation?

Accepted Answer

kms:GenerateDataKey

Answer

kms:Decrypt

Answer

kms:ReEncrypt

Answer

kms:CreateKey