Correct Answer: AWS Secrets Manager
Secrets Manager is specialized for credentials, offering native rotation for RDS/Aurora and detailed audit logging via CloudTrail....
Correct Answer
AWS Secrets Manager
Why This Answer Is Correct
Secrets Manager is specialized for credentials, offering native rotation for RDS/Aurora and detailed audit logging via CloudTrail.
This question evaluates your knowledge of AWS KMS — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding AWS KMS is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
You are designing a solution for an audit firm that needs to store encrypted data in S3 for 10 years. They require that the encryption keys are rotated annually and that no one, including AWS, can access the cleartext keys. Which AWS KMS key type and rotation should you use?
An organization is using Amazon S3 to store patient records. They must ensure that the records are encrypted at rest with keys that they rotate every 90 days and that AWS itself cannot access. Which KMS key configuration meets this requirement?
Which AWS security service allows you to automatically rotate your database passwords every 30 days and provides a managed way to inject these secrets into your Lambda functions without human intervention?
An organization wants to ensure that all their critical S3 buckets are encrypted with keys that only they physically possess in an on-premises HSM. Which KMS feature allows you to use your own HSM as the back-end for KMS encryption?