Q51 — AWS SAA-C03 Ch.12

Question 51 of 100 | ← Chapter 12

Q851. A company is planning to migrate data to an Amazon S3 bucket. The data must be encrypted at rest within the S3 bucket. The encryption key must be rotated automatically every year.Which solution will meet these requirements with the LEAST operational overhead?

• A. Migrate the data to the S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE- S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.
• B. Create an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket's default encryption behavior to use the customer managed KMS key.Migrate the data to the S3 bucket. ✓
• C. Create an AWS Key Management Service (AWS KMS) customer managed key. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket.Manually rotate the KMS key every year.
• D. Use customer key material to encrypt the data. Migrate the data to the S3 bucket. Create an AWS Key Management Service (AWS KMS) key without key material. Import the customer key material into the KMS key. Enable automatic key rotation.

Correct Answer: B. Create an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket's default encryption behavior to use the customer managed KMS key.Migrate the data to the S3 bucket.

Explanation

To meet the requirements of encrypting data at rest within an Amazon S3 bucket and automatically rotating the encryption key every year with the least operational overhead, the recommended solution is:B. Create an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket.Here's why:Option B suggests creating an AWS Key Management Service (AWS KMS) customer managed key, enabling automatic key rotation, and setting the S3 bucket's default encryption behavior to use the customer managed KMS key.By using a customer managed key in AWS KMS, you have control over the key and can enable automatic key rotation. AWS KMS will automatically rotate the key every year, reducing operational overhead.Setting the S3 bucket's default encryption behavior to use the customer managed KMS key ensures that all objects stored in the bucket are encrypted with the specified key.This solution meets the requirement of automatically rotating the encryption key every year without the need for manual intervention. It provides a higher level of control and security compared to using server-side encryption with Amazon S3 managed keys (SSE-S3) in option A.Option A suggests using SSE-S3 with built-in key rotation behavior. While SSE-S3 provides encryption at rest, it does not offer the same level of control and key management capabilities as AWS KMS customer managed keys.Option C suggests using AWS KMS customer managed keys but requires manual key rotation every year, which adds operational overhead and requires manual intervention.Option D suggests using customer key material and importing it into an AWS KMS key. This option introduces additional complexity and potential security risks associated with managing and importing customer key material.In summary, option B provides the least operational overhead by using AWS KMS customer managed keys with automatic key rotation and setting the S3 bucket's default encryption behavior to use the customer managed key. This solution ensures data encryption at rest and meets the requirement of automatic key rotation every year.