Correct Answer: An optional set of key-value pairs that provides additional authenticated data (AAD) to ensure integrity and prevent tampering
If an encryption context is provided during encryption, it must be provided during decryption, making it a powerful security control....
Correct Answer
An optional set of key-value pairs that provides additional authenticated data (AAD) to ensure integrity and prevent tampering
Why This Answer Is Correct
If an encryption context is provided during encryption, it must be provided during decryption, making it a powerful security control.
This question evaluates your knowledge of AWS KMS — a core concept tested in AWS Certified Solutions Architect – Associate (SAA-C03). Understanding AWS KMS is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
A solutions architect is designing an encryption strategy for S3. The company wants to manage the keys in AWS but requires that the keys cannot be exported from the AWS KMS service. Which key type should be used?
What is the difference between an 'Symmetric' and 'Asymmetric' KMS key?
To improve security and meet compliance, a company wants to automatically rotate their Customer Managed Keys every year. How is this enabled in KMS?
Which KMS feature allows you to use the same key material for data in multiple AWS regions to support disaster recovery scenarios without re-encrypting data?