Q21 — AWS SAA-C03 Ch.17

Question 21 of 89 | ← Chapter 17

Q1321. A company stores petabytes of historical medical information on premises. The company has a process to manage encryption of the data to comply with regulations.The company needs a cloud-based solution for data backup, recovery, and archiving. The company must retain control over the encryption key material.Which combination of solutions will meet these requirements?(Select TWO.)

Correct Answer: A. Create an AWS Key Management Service(AWS KMS) key without key material. Import the company's key material into the KMS key, D. Store the data in an Amazon S3 Glacier storage class. Use server-side encryption with customer- provided keys(SSE-C).

Explanation

The company needs a cloud-based backup, recovery, and archiving solution while retaining control over encryption key material (to comply with regulations). The correct combination of solutions is:Correct Answers:A. Create an AWS KMS key without key material. Import the company's key material into the KMS key. D. Store the data in an Amazon S3 Glacier storage class. Use server-side encryption with customer- provided keys (SSE-C).Why These Options Are Correct?A. Import Customer-Managed Key Material into AWS KMS (BYOK) AWS KMS supports "Bring Your Own Key (BYOK)" via imported key material.The company can:Generate a symmetric encryption key (e.g., AES-256) using an HSM or on-premises key management system.Create an AWS KMS customer-managed key (CMK) without key material.Import the company's key material into the CMK.Benefits:Full control over encryption keys (AWS never sees the raw key material). Compliance: Meets regulatory requirements for key ownership. Integration: Works with AWS services like S3, EBS, and RDS for encryption. D. Store Data in S3 Glacier with SSE-C (Customer-Provided Keys) S3 Glacier is ideal for long-term archiving (cost-effective, durable). SSE-C (Server-Side Encryption with Customer-Provided Keys) allows:The company to provide its own encryption keys (e.g., via an HSM or key management system). AWS manages storage and encryption/decryption only when the correct key is provided.Benefits:No AWS-managed keys Full key control.Low-cost archival with high durability (11 nines).Compliance: Meets strict regulatory requirements for key custody.Why Other Options Are Incorrect?B. Use AWS KMS-Generated Key MaterialIncorrect because AWS-generated keys mean AWS manages the key material, violating the requirement for customer control.Best for: General-purpose encryption where key ownership is not a concern.C. Use S3 Standard-IA with S3 Bucket KeysIncorrect because:S3 Bucket Keys reduce costs but use AWS-managed KMS keys (no customer control). S3 Standard-IA is for infrequently accessed data, not long-term archival (Glacier is cheaper).E. Use AWS Snowball with SSE-KMSIncorrect because:Snowball is for large-scale data transfer, not ongoing backup/archival.SSE-KMS uses AWS-managed keys, not customer-provided keys.Best Practice CombinationFor active archival (occasional retrieval):S3 Glacier Deep Archive (cheapest) + SSE-C (customer keys).For importing existing keys into AWS KMS (BYOK):Create a KMS CMK without key material Import company-owned keys.For data transfer (if needed):Use AWS Snowball (but encryption must be handled externally or via SSE-C if supported).ConclusionThe best solutions for cloud-based archival with customer-controlled keys are:A (AWS KMS BYOK) + D (S3 Glacier + SSE-C).Other options either relinquish key control (B, C) or are not archival-focused (E).