Correct Answer: AWS KMS
AWS KMS is a managed service that makes it easy to create and control the cryptographic keys used to encrypt your data....
Correct Answer
AWS KMS
Why This Answer Is Correct
AWS KMS is a managed service that makes it easy to create and control the cryptographic keys used to encrypt your data.
This question evaluates your knowledge of AWS KMS — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding AWS KMS is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
You are designing a solution for an audit firm that needs to store encrypted data in S3 for 10 years. They require that the encryption keys are rotated annually and that no one, including AWS, can access the cleartext keys. Which AWS KMS key type and rotation should you use?
An organization wants to centralize the management of their secrets (API keys, DB passwords, etc.) across 50 AWS accounts. They want to ensure they can rotate passwords without downtime and audit who accessed the secrets. Which service is appropriate?
An organization is using Amazon S3 to store patient records. They must ensure that the records are encrypted at rest with keys that they rotate every 90 days and that AWS itself cannot access. Which KMS key configuration meets this requirement?
Which AWS security service allows you to automatically rotate your database passwords every 30 days and provides a managed way to inject these secrets into your Lambda functions without human intervention?
An organization wants to ensure that all their critical S3 buckets are encrypted with keys that only they physically possess in an on-premises HSM. Which KMS feature allows you to use your own HSM as the back-end for KMS encryption?