Correct Answer: KMS External Key Store (XKS)
XKS allows AWS KMS to use a key store located outside of AWS (like your on-prem HSM), providing the highest level of cryptographic control....
Correct Answer
KMS External Key Store (XKS)
Why This Answer Is Correct
XKS allows AWS KMS to use a key store located outside of AWS (like your on-prem HSM), providing the highest level of cryptographic control.
This question evaluates your knowledge of AWS KMS — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding AWS KMS is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
You are designing a solution for an audit firm that needs to store encrypted data in S3 for 10 years. They require that the encryption keys are rotated annually and that no one, including AWS, can access the cleartext keys. Which AWS KMS key type and rotation should you use?
An organization wants to centralize the management of their secrets (API keys, DB passwords, etc.) across 50 AWS accounts. They want to ensure they can rotate passwords without downtime and audit who accessed the secrets. Which service is appropriate?
An organization is using Amazon S3 to store patient records. They must ensure that the records are encrypted at rest with keys that they rotate every 90 days and that AWS itself cannot access. Which KMS key configuration meets this requirement?
Which AWS security service allows you to automatically rotate your database passwords every 30 days and provides a managed way to inject these secrets into your Lambda functions without human intervention?