KMS KMS

A social photo-sharing company uses Amazon S3 to store the images uploaded by the users. These images are kept encrypted in S3 by using AWS-KMS and the company manages its own Customer Master Key (CMK) for encryption. A member of the DevOps team accidentally deleted the CMK a day ago, thereby rendering the user's photo data unrecoverable. You have been contacted by the company to consult them on possible solutions to this crisis.

As a solutions architect, which of the following steps would you recommend to solve this issue?

• As the CMK was deleted a day ago, it must be in the 'pending deletion' status and hence you can just cancel the CMK deletion and recover the key

• Contact AWS support to retrieve the CMK from their backup

• The CMK can be recovered by the AWS root account user

• The company should issue a notification on its web application informing the users about the loss of their data

A retail company wants to share sensitive accounting data that is stored in an Amazon RDS DB instance with an external auditor. The auditor has its own AWS account and needs its own copy of the database.

Which of the following would you recommend to securely share the database with the auditor?

• Create an encrypted snapshot of the database, share the snapshot, and allow access to the AWS Key Management Service (AWS KMS) encryption key

• Create a snapshot of the database in Amazon S3 and assign an IAM role to the auditor to grant access to the object in that bucket

• Export the database contents to text files, store the files in Amazon S3, and create a new IAM user for the auditor with access to that bucket

• Set up a read replica of the database and configure IAM standard database authentication to grant the auditor access

The engineering team at a social media company has recently migrated to AWS Cloud from its on-premises data center. The team is evaluating CloudFront to be used as a CDN for its flagship application. The team has hired you as an AWS Certified Solutions Architect Associate to advise on CloudFront capabilities on routing, security, and high availability.

Which of the following would you identify as correct regarding CloudFront? (Select three)

• CloudFront can route to multiple origins based on the content type

• Use an origin group with primary and secondary origins to configure CloudFront for high availability and failover

• Use field level encryption in CloudFront to protect sensitive data for specific content

• Use geo restriction to configure CloudFront for high-availability and failover

• Use KMS encryption in CloudFront to protect sensitive data for specific content

To enable In-flight Encryption (In-Transit Encryption), we need to have ........................

• an HTTP endpoint with an SSL certificate

• an HTTPS endpoint with an SSL certificate

• a TCP endpoint

Answer explanation

In-flight Encryption = HTTPS, and HTTPS can not be enabled without an SSL certificate.

Server-Side Encryption means that the data is sent encrypted to the server

• True

• False

Answer explanation

Server-Side Encryption means the server will encrypt the data for us. We don't need to encrypt it beforehand

In Server-Side Encryption, where do the encryption and decryption happen?

• Both Encryption and Decryption happen on the server

• Both Encryption and Decryption happen on the client

• Encryption happens on the server and Decryption happens on the client

In Client-Side Encryption, the server must know our encryption scheme before we can upload the data

• True

• False

Answer explanation

With Client-Side Encryption, the server doesn't need to know any information about the encryption scheme being used, as the server will not perform any encryption or decryption operations.