Q94 — AWS SAA-C03 Ch.13

Question 94 of 100 | ← Chapter 13

Q994. A company is designing an application on AWS that processes sensitive data. The application stores and processes financial data for multiple customers.To meet compliance requirements, the data for each customer must be encrypted separately at rest by using a secure, centralized key management solution. The company wants to use AWS Key Management Service (AWS KMS) to implement encryption.Which solution will meet these requirements with the LEAST operational overhead?

• A. Generate a unique encryption key for each customer. Store the keys in an Amazon S3 bucket. Enable server-side encryption.
• B. Deploy a hardware security appliance in the AWS environment that securely stores customer-provided encryption keys. Integrate the security appliance with AWS KMS to encrypt the sensitive data in the application.
• C. Create a single AWS KMS key to encrypt all sensitive data across the application.
• D. Create separate AWS KMS keys for each customer's data that have granular access control and logging enabled. ✓

Correct Answer: D. Create separate AWS KMS keys for each customer's data that have granular access control and logging enabled.

Explanation

To meet the compliance requirements of encrypting sensitive financial data for multiple customers separately at rest using AWS Key Management Service (AWS KMS) with the least operational overhead, the best solution is:D. Create separate AWS KMS keys for each customer's data that have granular access control and logging enabled.Explanation:Separate KMS Keys: By creating individual KMS keys for each customer, you ensure that each customer's data is encrypted separately. This aligns with the requirement for compliance and data isolation.Granular Access Control: AWS KMS allows you to define fine-grained access control policies for each key, ensuring that only authorized users and services can access the keys. This enhances security and meets compliance standards.Logging: AWS KMS integrates with AWS CloudTrail, allowing you to log key usage. This is critical for auditing and compliance, providing visibility into how keys are used across the application.Evaluation of Other Options:A. Generate a unique encryption key for each customer...: While generating unique keys is good, storing them in an S3 bucket introduces additional complexity and operational overhead in managing key security and access.B. Deploy a hardware security appliance...: This option involves significant operational overhead, including maintenance and integration challenges. It is not necessary when AWS KMS provides a fully managed key management solution.C. Create a single AWS KMS key to encrypt all sensitive data...: This approach does not meet the requirement for separate encryption per customer and could lead to compliance issues, as it does not provide data isolation.In summary, Option D is the most effective solution for securely managing customer data encryption with minimal operational overhead while meeting compliance requirements.