SAP-C03 practice question: Encryption at rest, key policies and post-quantum cryptography (AWS KMS) (1 of 2)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A car maker signs its vehicle firmware images with AWS KMS asymmetric keys. Each vehicle verifies the signature before installing an update, and a vehicle stays on the road for about 15 years.
The security team wants the signing keys to remain secure against future quantum computers, so a firmware image signed today must still be trustworthy when a vehicle reads it in 2040. The signing service must keep using KMS in the company's account, and the team does not want to build its own signing service.
Which solution meets these requirements?
Choose one answer.
AA. Create a KMS signing key with an RSA 4096-bit key spec, and replace it with a new key every year so that a compromised key is retired quickly.
BB. Create an ECC_NIST_P521 signing key, the largest elliptic-curve key spec that KMS offers, and sign each firmware image with ECDSA and SHA-512.
CC. Create a KMS asymmetric signing key with an ML-DSA key spec, and sign each firmware image through the KMS Sign API, using the external mu message type for large images.
DD. Move the firmware signing into an AWS CloudHSM cluster with an RSA key, and let the build servers call the HSM directly.
Show the answer and explanation
Answer: C
A. Wrong: RSA is a classical algorithm at any key size, so yearly replacement does not make the signatures resistant to a future quantum attacker. KMS also does not rotate asymmetric keys automatically, so the replacement would be manual work.
B. Wrong: A larger curve is still a classical algorithm, and a large enough quantum computer could break elliptic-curve signatures whatever the curve size. The option does not meet the quantum-resistance requirement.
C. Right: Correct. KMS supports ML-DSA post-quantum signing keys (ML_DSA_44, ML_DSA_65 and ML_DSA_87), so the signatures do not rely on algorithms that a future quantum computer could break. The images are signed through the KMS Sign API in the company's account, with no custom signing service.
D. Wrong: CloudHSM gives dedicated hardware, but an RSA key inside it is still a classical algorithm. The option also requires the team to manage the HSM client and signing integration.
Explanation
KMS supports post-quantum signing with ML-DSA key specs, which keeps the signing in KMS and protects signatures over the long vehicle lifetime. RSA and elliptic-curve keys are classical at any size, and an RSA key in CloudHSM leaves KMS and still uses a classical algorithm.
Want more on Encryption at rest, key policies and post-quantum cryptography (AWS KMS)? The 5 full-length practice sets have 10 more Encryption at rest, key policies and post-quantum cryptography (AWS KMS) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →