ExamPark
Course menuDVA-C03

Exams / DVA-C03 / Encryption with AWS KMS / Question 1

DVA-C03 practice question: Encryption with AWS KMS (1 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A media company archives 200 MB video files, and a client-side process must encrypt each one with a customer managed AWS KMS key before it is stored.

Passing a whole file to the KMS Encrypt API fails because the file is too large. The company wants the fewest KMS API calls per file, and the key material of the KMS key must never leave KMS.

Which approach meets these requirements?

Choose one answer.

  1. A. Split each file into 4 KB pieces and call the KMS Encrypt API once for every piece, so that each call stays within its size limit.
  2. B. Create an asymmetric RSA KMS key and call Encrypt on the whole file, because RSA keys are meant for large inputs.
  3. C. Call GenerateDataKey, encrypt each file locally with the plaintext data key, and store the encrypted data key with the file.
  4. D. Call GenerateDataKeyWithoutPlaintext and use the encrypted data key that it returns to encrypt each file locally.
Show the answer and explanation

Answer: C

  • A. Wrong: Encrypt accepts at most 4,096 bytes of plaintext, so pieces of that size are accepted. But a 200 MB file would need about 50,000 calls, which is the opposite of keeping KMS calls to a minimum and invites throttling. Envelope encryption needs one call per file. Learn more: Encrypt API (opens in a new tab)
  • B. Wrong: RSA keys accept far less plaintext than symmetric keys: at most a few hundred bytes per call, depending on key size. The file would still be rejected, and a symmetric key with data keys is the right design. Learn more: Encrypt API (opens in a new tab)
  • C. Right: Correct. This is envelope encryption: KMS protects a small data key under the KMS key, and the large file is encrypted locally. The client keeps the encrypted data key with the file, discards the plaintext key and calls Decrypt on the data key when reading. Learn more: GenerateDataKey API (opens in a new tab)
  • D. Wrong: This operation returns only the encrypted copy of a data key, which is useless for local encryption until it is decrypted. An extra Decrypt call would then be needed for every file, so GenerateDataKey is the direct choice. Learn more: GenerateDataKey API (opens in a new tab)

Explanation

KMS Encrypt handles at most 4,096 bytes, so large files use envelope encryption. GenerateDataKey returns a plaintext data key for local encryption and an encrypted copy to store with the file, and the KMS key itself never leaves KMS. Chunking, RSA keys and the without-plaintext variant either multiply calls or still cannot encrypt the file.

Envelope encryption with a KMS data key The client calls GenerateDataKey once per file. KMS returns a plaintext data key and an encrypted copy, and the KMS key never leaves KMS. The client encrypts the file locally with the plaintext key, discards it, and stores the encrypted file with the encrypted data key. Call KMS GenerateDataKey one API call per file KMS returns two keys plaintext + encrypted the KMS key itself never leaves KMS Encrypt locally with the plaintext key then discard the plaintext key Store together file + encrypted key only KMS can decrypt the stored data key
One KMS call per file. To read the file later, send the stored encrypted data key to KMS Decrypt.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice Encryption with AWS KMSAll Encryption with AWS KMS questions

Want more on Encryption with AWS KMS? The 5 full-length practice sets have 16 more Encryption with AWS KMS questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets