AWS Certified Solutions Architect Associate SAA-C03 Practice Question
A financial services company is leveraging cloud storage services to retain transaction records. These records contain privileged client information that needs to be encrypted when not in use. The company's security team must have the capability to manage encryption keys centrally, including the facilitation of periodic, automated key changes. Which configuration should be implemented to meet these encryption management requirements?
You selected this option
Create customer controlled keys with enabled automated rotation on an annual schedule.
You selected this option
Create customer controlled keys and use a scheduled script to change the key material manually.
You selected this option
Rely on developers to generate and replace keys on a regular basis through a manual update process.
You selected this option
Implement managed service keys with a policy for key rotation every three years.
By choosing customer managed keys with enabled automatic rotation, the security team has central control over the encryption keys and satisfies the need for regular, automated updates to the key material. Built-in automatic rotation occurs yearly, reinforcing security best practices. Managed keys provided by the cloud service rotate less frequently, which does not meet the stricter rotation requirements typically desired for sensitive financial data. Using a Lambda function for manual rotation or relying on developers for key updates deviates from the requirement for automated processes, introducing potential human error and inconsistency in security practices.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are customer managed keys and how do they differ from managed service keys?
Open an interactive chat with Bash
What does automated key rotation involve and why is it important?
Open an interactive chat with Bash
How can organizations monitor and manage access to customer managed keys?