AWS Certified Solutions Architect Data Encryption with KMS 2

Question 1

A company wants to encrypt S3 objects so that only specific IAM roles can decrypt them, even if someone gains S3 bucket access. Which KMS feature best satisfies this requirement?

Accepted Answer

SSE-KMS with a customer managed key and a restrictive key policy

Answer

SSE-KMS with a customer managed key lets you attach a key policy that explicitly lists which IAM principals can use kms:Decrypt, independent of S3 bucket permissions.

Question 2

Which KMS key type allows you to import your own key material generated outside of AWS?

Accepted Answer

Customer managed key with imported key material

Answer

Customer managed keys support importing external key material, giving you full control over the cryptographic material while AWS manages the key infrastructure.

Question 3

An architect needs to encrypt data at rest in RDS using KMS. What happens to the automated backups when the RDS instance uses KMS encryption?

Accepted Answer

Backups are encrypted with the same KMS key as the RDS instance

Answer

RDS automated backups, snapshots, and read replicas inherit the same KMS key used to encrypt the source RDS instance.

Question 4

A Lambda function needs to decrypt a secret stored in AWS Secrets Manager. The secret is encrypted with a customer managed KMS key. What permission must the Lambda execution role have?

Accepted Answer

kms:Decrypt and secretsmanager:GetSecretValue

Answer

The Lambda execution role needs secretsmanager:GetSecretValue to retrieve the secret and kms:Decrypt to decrypt the data key that protects the secret value.

Question 5

What is the maximum size of data that can be encrypted directly using a KMS CMK via the Encrypt API call?

Accepted Answer

4 KB

Answer

KMS limits direct encryption via the Encrypt API to 4 KB; larger data must be encrypted using envelope encryption with a generated data key.

AWS Practice Test

AWS Practice Test

AWS Certified Solutions Architect Data Encryption with KMS 2