Q44 — AWS SAA-C03 Ch.11

Question 44 of 100 | ← Chapter 11

Q744. A company is required to use cryptographic keys in its on-premises key manager. The key manager is outside of the AWS Cloud because of regulatory and compliance requirements. The company wants to manage encryption and decryption by using cryptographic keys that are retained outside of the AWS Cloud and that support a variety of external key managers from different vendors.Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: B. Use an AWS Key Management Service (AWS KMS) external key store backed by an external key manager.

Explanation

To meet the requirements of using cryptographic keys retained outside of the AWS Cloud and supporting a variety of external key managers with the least operational overhead, the solution that would fulfill these requirements is:B. Use an AWS Key Management Service (AWS KMS) external key store backed by an external key manager.Option B, using an AWS Key Management Service (AWS KMS) external key store backed by an external key manager, is the most suitable solution for this scenario with the least operational overhead. AWS KMS allows you to create and manage customer master keys (CMKs) that can be stored in an external key manager. This enables you to use your on-premises key manager that is outside the AWS Cloud, satisfying the regulatory and compliance requirements. By utilizing the AWS KMS external key store feature, you can seamlessly integrate your external key manager with AWS KMS to perform encryption and decryption operations in a secure and compliant manner.Option A, using AWS CloudHSM key store backed by a CloudHSM cluster, is not the ideal choice for this scenario. While AWS CloudHSM provides a dedicated hardware security module (HSM) to securely store cryptographic keys, it does not support integration with external key managers. Therefore, it does not meet the requirement of using cryptographic keys retained outside of the AWS Cloud and supporting different external key managers.Option C, using the default AWS Key Management Service (AWS KMS) managed key store, is not suitable for this scenario as it does not allow for the integration of external key managers. The default AWS KMS managed key store is a fully managed service provided by AWS, and the keys are stored within AWS infrastructure.Option D, using a custom key store backed by an AWS CloudHSM cluster, also does not fulfill the requirement of supporting different external key managers. Custom key stores in AWS KMS are primarily used to leverage AWS CloudHSM for key storage and management, but they do not provide the flexibility to integrate with external key managers.Therefore, the solution that meets the requirements of using cryptographic keys retained outside of the AWS Cloud and supporting a variety of external key managers with the least operational overhead is B: Use an AWS Key Management Service (AWS KMS) external key store backed by an external key manager.