MENU
A company has an application that uses AWS Key Management Service (AWS KMS) to encrypt and decrypt dat
a. The application stores data in an Amazon S3 bucket in an AWS Region. Company security policies require the data to be encrypted before the data is placed into the S3 bucket. The application must decrypt the data when the application reads files from the S3 bucket.
The company replicates the S3 bucket to other Regions. A solutions architect must design a solution so that the application can encrypt and decrypt data across Regions. The application must use the same key to decrypt the data in each Region.
Which solution will meet these requirements?
Suggested Answer: A
Get Premium SAP-C02 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
26 comments · newest first
MA
Matthew
11 months ago
I thought KMS keys were region-specific, how does A work?
RO
Ronnie
11 months ago
Wait, can you really replicate keys like that? Sounds risky!
DE
Derrick
11 months ago
B seems simpler, but it doesn't meet the multi-Region requirement.
VE
Veronika
11 months ago
Totally agree, A makes it easy to manage keys across Regions!
EL
Elvera
12 months ago
A is the best option for multi-Region KMS keys.
KA
Katie
12 months ago
Option D seems risky to me. Storing key material in Parameter Store could expose it, and I don't think it's the best practice for security.
ST
Staci
1 year ago
I practiced a similar question about KMS and S3, and I feel like option C is off-topic since it talks about certificates rather than encryption keys.
AM
Amie
1 year ago
I'm not entirely sure, but I think option B might not meet the requirement of using the same key across Regions. It seems like it would create separate keys instead.
GI
Gilma
1 year ago
I remember studying about KMS multi-Region keys, so option A sounds familiar. I think it allows for seamless encryption across Regions.
MA
Marjory
1 year ago
I'm not sure about using the Parameter Store to store the key material. That seems a bit risky to me. I'd be more comfortable with the multi-Region primary key approach.
RO
Ronna
1 year ago
Okay, I think I've got a handle on this. The key is to use a multi-Region primary key and create replica keys in each Region. That way the app can use the same key to encrypt and decrypt data.
LE
Leonardo
1 year ago
Hmm, I'm a bit confused by the multi-Region aspect. I'll need to make sure I understand how KMS keys and replication work across Regions.
TH
Thaddeus
1 year ago
This looks like a tricky one. I'll need to carefully read through the requirements and think through the different options.
WI
Willard
2 years ago
Ha! I bet the guy who wrote option B is the same one who thought 'just create a new key in each Region' was a good idea. That's like the IT version of 'have you tried turning it off and on again?'
DA
Dan
2 years ago
Option D is interesting, but storing the key material in Parameter Store? That could get messy and might not be as secure as using KMS directly.
LO
Loise
2 years ago
I agree, Option A seems like the most secure and efficient solution. Creating a KMS multi-Region primary key and replica keys in each Region makes sense.
ER
Ernest
2 years ago
Option D is definitely not the best choice for this scenario. Storing key material in Parameter Store can be risky.
TY
Tyisha
2 years ago
Option A all the way. Multi-Region KMS keys is the only way to go if you want to keep things simple and secure. Plus, it's the AWS-recommended solution, so it's gotta be good, right?
CH
Charlena
2 years ago
Option A seems like the way to go. Using a multi-Region primary key and replica keys in each Region sounds like the best approach to ensure data can be decrypted across Regions.
CH
Chandra
2 years ago
Updating the application code to use specific replica keys in each Region is key to maintaining data security.
EL
Elli
2 years ago
It's important to ensure that the application can access the same key in each Region for decryption.
LY
Lyda
2 years ago
Creating a multi-Region primary key and replica keys will definitely help with decrypting data across Regions.
KA
Katy
2 years ago
I agree, Option A seems like the most efficient solution.
KE
Kerrie
2 years ago
But option A ensures that the application uses the same key to decrypt data in each Region, which is important for consistency.
DE
Dell
2 years ago
I disagree, I believe option B is more practical as it creates a new customer managed KMS key in each Region.
KE
Kerrie
2 years ago
I think option A is the best solution because it allows for a multi-Region primary key and replica key in each additional Region.