Exams / DVA-C02 / Encryption with AWS KMS / Question 1
DVA-C02 practice question: Encryption with AWS KMS (1 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An application must encrypt files of up to 200 MB with a customer managed AWS KMS key before storing them. The developer's first attempt passes each file to the KMS Encrypt API, which fails because the data is too large. What should the developer do instead?
Choose one answer.
- AA. Split each file into small chunks and call the Encrypt API once for each chunk.
- BB. Compress each file until it is small enough for a single call to the Encrypt API.
- CC. Create an asymmetric KMS key instead, because it accepts larger inputs than symmetric keys.
- DD. Call GenerateDataKey, encrypt locally with the plaintext key, store the encrypted key.
Show the answer and explanation
Answer: D
- A. Wrong: This would make thousands of KMS calls per file and is not how KMS is meant to be used for bulk data.
- B. Wrong: Encrypt accepts at most 4 KB of plaintext, so compression would almost never get a 200 MB file small enough.
- C. Wrong: Asymmetric keys accept even smaller payloads than symmetric keys, and they do not lift the size limit.
- D. Right: Correct. This is envelope encryption: KMS protects only the small data key, and the data is encrypted locally.
Explanation
The KMS Encrypt API takes at most 4096 bytes of plaintext with a symmetric key. For larger data, use envelope encryption: GenerateDataKey returns a plaintext data key and a copy encrypted under the KMS key. Encrypt the data locally, erase the plaintext key from memory, and store the encrypted key with the data. To decrypt, call Decrypt on the data key first.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.