Q62 — AWS SAA-C03 Ch.17

Question 62 of 89 | ← Chapter 17

Q1362. A home security company is expanding its business globally. The company needs to encrypt customer data. The company does not want to manage its own keys. The company needs the keys to be usable in multiple AWS Regions and needs to control access to the keys.Which solution will meet these requirements with the LEAST operational overhead?

• A. Use AWS KMS to create multi-Region keys. Apply tags to identify each key. Use attribute-based access control(ABAC) condition keys to control access to the keys. ✓
• B. Use AWS KMS to create multiple keys by importing key material. Apply tags to identify each key. Use attribute-based access control(ABAC) condition keys to control access to the keys. access to the keys.
• C. Use AWS CloudHSM to create a CloudHSM cluster in the company's primary Region. Synchronize the CloudHSM cluster to additional Regions by using the CloudHSM Management Utility(CMU).
• D. Use AWS CloudHSM to create users. Use the CloudHSM Management Utility(CMU) to share keys with the users. Use the shareKey command to share or unshare the key with additional users in each Region.

Correct Answer: A. Use AWS KMS to create multi-Region keys. Apply tags to identify each key. Use attribute-based access control(ABAC) condition keys to control access to the keys.

Explanation

The correct answer is A. Use AWS KMS to create multi-Region keys. Apply tags to identify each key. Use attribute-based access control (ABAC) condition keys to control access to the keys.Explanation:The home security company needs:Encryption of customer data (secure key management).No key management overhead (AWS handles key lifecycle).Keys usable in multiple AWS Regions (global accessibility). Fine-grained access control (only authorized users/services can use keys).Why Option A is the Best Choice:AWS KMS Multi-Region KeysAutomatically replicates keys across Regions Ensures low-latency access globally. AWS manages key rotation and backups No operational overhead. Centralized control Single key policy applies across all Regions.Tags for Key IdentificationHelps organize and track keys (e.g., by environment, region, or purpose).Attribute-Based Access Control (ABAC)Uses condition keys (e.g., kms:ViaAWSService, aws:PrincipalTag) to dynamically control access. More flexible than IAM policies alone (e.g., allowing access based on user attributes like department or region).Why Other Options Are Incorrect:B. Import key material into multiple single-Region keysManual key replication required High operational overhead (must manage keys in each Region separately).No automatic synchronization Risk of inconsistency if keys are rotated.C. Use AWS CloudHSM with CMU synchronizationCloudHSM requires self-managed HSM clusters High operational overhead (patching, scaling, backups).CMU synchronization is complex Not ideal for a company wanting to avoid management tasks.D. Use CloudHSM users and shareKey commandEven more manual Requires explicit key sharing per user/Region (error-prone and inefficient). CloudHSM is not multi-Region by default Needs additional setup for cross-Region access.Comparison Table:OptionMulti-Region SupportAWS-Managed KeysAccess Control FlexibilityOperational OverheadBest For A(Automatic)(AWS manages)(ABAC) (Minimal)Global, low-maintenance encryption B (Manual) (Self-managed) (IAM-only)(High)Legacy systems needing key import C (Requires sync) (Self-managed) (Basic IAM)(Very high)HSM compliance (e.g., FIPS 140-2 Level 3) D (Manual sharing) (Self-managed) (Basic IAM)(Extreme)Niche use cases needing granular key sharing Conclusion:Option A is the most secure, scalable, and low-maintenance solution because:AWS KMS Multi-Region keys handle replication automatically. ABAC provides fine-grained access control without manual policy updates. No self-managed infrastructure Reduces operational complexity.Avoid Options B, C, and D (they introduce unnecessary management tasks or lack multi-Region support).Final Answer: A