Q28 — AWS SAA-C03 Ch.11

Question 28 of 100 | ← Chapter 11

Q728. A company uses Amazon Elastic Kubernetes Service (Amazon EKS) to run a container application. The EKS cluster stores sensitive information in the Kubernetes secrets object. The company wants to ensure that the information is encrypted.Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: B. Enable secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS).

Explanation

To meet the requirement of encrypting sensitive information stored in the Kubernetes secrets object in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with the least operational overhead, the most suitable solution is:B. Enable secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS).Option B, enabling secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS), is the recommended solution to meet the requirements with minimal operational overhead:- Secrets encryption in EKS: EKS provides a built-in feature to encrypt secrets stored in the Kubernetes secrets object. By enabling this feature, EKS automatically encrypts the secret data at rest using AWS KMS.Enabling secrets encryption in the EKS cluster is a straightforward and low-overhead solution. It leverages native EKS functionality and does not require additional development or management of encryption logic.Option A, using the container application to encrypt the information by using AWS KMS, would require modifying the container application code and managing the encryption process within the application. This approach increases the operational overhead and complexity.Option C, implementing an AWS Lambda function to encrypt the information by using AWS KMS, introduces unnecessary complexity. Using a Lambda function for encryption would require additional infrastructure, configuration, and management of the function, which is not the most efficient approach in this scenario.Option D, using AWS Systems Manager Parameter Store to encrypt the information by using AWS KMS, is not the recommended solution for encrypting data stored in the Kubernetes secrets object. Systems Manager Parameter Store is primarily used for managing configuration data, and it does not provide native integration with the Kubernetes secrets object.Therefore, the solution that meets the requirements with the least operational overhead is B: Enable secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS). This solution ensures that sensitive information stored in the Kubernetes secrets object is automatically encrypted at rest without the need for additional development or management efforts.