AWS Security 06 cnetbuild

T/F KMS is regional and you can only use the key in the region the key was created in

• true
• false

Someone needs to tempoarily use the CMK to encrypt some data. What is the best way to accomplish this

• KMS grant
• Key Policy
• AIM policy
• KMS key user

You would like a KMS condition to take effect after a condition (such as a specific date). What would you use?

• KMS Policy Conditions (kms:ViaService)
• KMS Grant (create-grant)
• Lamda
• Config

You have a KMS key that you only want used with data stored in S3. How would you control that?

• KMS Policy Conditions (kms:ViaService)
• KMS Grant (create-grant)
• AIM policy
• EBS Encryption

Policy condiitions can be used to specify a condition within __

• either option
• key policy
• IAM Policy
• neither option

Access to KMS CMKs is controller using

• both options
• Key Policy
• IAM Policy
• neither option

In KMS, the CMK administrator and users are defined where

• key policy
• IAM policy
• both option
• neither option
• Cross Account Access

In KMS, __ grants permission to users (or roles) granting permission to perfor actions with the CMK

• IAM policy

• key Policy

• All answers

• None of the answers

• Cross Account Access

You would like an external account to be able to use the KMS CMK to encrypt or decrypt. What should you use?

• Cross Account Access
• IAM policy
• key Policy
• both options
• neither option

What must you do to setup kms cross account access

• Both Answers
• In the external account's IAM policy, define the allowed actions to the CMK resoure (ARN)
• Grant the root user of the external account access in the key's Key Policy
• Neither answer