ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

In a GPG Web-of-Trust, keys become trusted when other already-trusted users certify them. Each EC2 instance (or more practically, the configuration management process that runs during bootstrap) must import the new engineer's public key and then apply a local signature from a key that the instance already trusts-typically the operations team's master signing key. This establishes transitive trust, enabling the instance to validate any scripts the engineer signs.

Adding the key to AWS Certificate Manager or obtaining an X.509 certificate would shift to a hierarchical PKI rather than the decentralized Web-of-Trust model. Storing the private key in Secrets Manager would violate key-management best practices and is unnecessary for signature verification. Simply distributing the public key without signing it does not confer trust; the instance would still treat the key as unknown and refuse to trust the signatures.