Q69 — AWS SAA-C03 Ch.11

Question 69 of 100 | ← Chapter 11

Q769. A company uses Amazon EC2 instances and stores data on Amazon Elastic Block Store (Amazon EBS) volumes. The company must ensure that all data is encrypted at rest by using AWS Key Management Service (AWS KMS). The company must be able to control rotation of the encryption keys.Which solution will meet these requirements with the LEAST operational overhead?

• A. Create a customer managed key. Use the key to encrypt the EBS volumes. ✓
• B. Use an AWS managed key to encrypt the EBS volumes. Use the key to configure automatic key rotation.
• C. Create an external KMS key with imported key material. Use the key to encrypt the EBS volumes.
• D. Use an AWS owned key to encrypt the EBS volumes.

Correct Answer: A. Create a customer managed key. Use the key to encrypt the EBS volumes.

Explanation

To meet the requirements of encrypting data at rest on Amazon Elastic Block Store (Amazon EBS) volumes using AWS Key Management Service (AWS KMS) with the ability to control key rotation and minimize operational overhead, the most suitable solution is:A. Create a customer managed key. Use the key to encrypt the EBS volumes.Option A provides the desired solution with the least operational overhead:Create a customer managed key:A customer managed key (CMK) is a type of AWS KMS key that you can create, own, and manage. By creating a CMK, you have full control over the key and its rotation.Use the key to encrypt the EBS volumes:Once the CMK is created, it can be used to encrypt the EBS volumes. When creating or modifying an EBS volume, you can choose the CMK to encrypt the data at rest.Here's why the other options are not the most suitable choices:Option B suggests using an AWS managed key to encrypt the EBS volumes and configuring automatic key rotation. While this option provides key rotation functionality, AWS managed keys are owned and managed by AWS, and you do not have control over their rotation. Therefore, it does not meet the requirement of being able to control the key rotation.Option C suggests creating an external KMS key with imported key material. This option involves additional complexity as it requires importing external key material into AWS KMS. This may result in higher operational overhead for managing the key material and does not offer any significant advantages for the given requirements.Option D suggests using an AWS owned key to encrypt the EBS volumes. AWS owned keys are managed by AWS, and you do not have control over their rotation. This option does not meet the requirement of being able to control the key rotation.Therefore, the most appropriate solution to encrypt data at rest on Amazon EBS volumes using AWS KMS, while allowing control over key rotation and minimizing operational overhead, is:A. Create a customer managed key. Use the key to encrypt the EBS volumes.