SAP-C03 practice question: Encryption at rest, key policies and post-quantum cryptography (AWS KMS) (2 of 2)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A retailer's backup tool writes nightly dump files of its 4 TB order database and encrypts them on the client side with the AWS Encryption SDK, using a customer managed KMS key in eu-west-1. The files are copied to an S3 bucket in eu-central-1 for disaster recovery.
During a recovery, the team must decrypt the files in eu-central-1 with no dependency on the eu-west-1 Region. The team does not want a job that decrypts and re-encrypts the files, and key rotation in eu-west-1 must also apply to the key used in eu-central-1.
Which solution meets these requirements?
Choose one answer.
AA. Keep the single-Region key in eu-west-1, and have the recovery process in eu-central-1 call KMS in eu-west-1 to decrypt the data keys of the dump files.
BB. Create a separate single-Region key in eu-central-1, and have a nightly job decrypt each copied file with the eu-west-1 key and re-encrypt it with the eu-central-1 key.
CC. Create a multi-Region primary key in eu-west-1 and a replica key in eu-central-1, encrypt the dump files with the primary key, and decrypt them with the replica during a recovery.
DD. Write a second, unencrypted copy of each dump file to the eu-central-1 bucket, and rely on the bucket's default SSE-S3 encryption so that the recovery needs no KMS key at all.
Show the answer and explanation
Answer: C
A. Wrong: The recovery depends on the KMS endpoint in eu-west-1, which fails when eu-west-1 is the Region that went down. This is the dependency the team wants to remove.
B. Wrong: This removes the recovery-time dependency, but it is the decrypt and re-encrypt job the team wants to avoid. The two keys are also unrelated, so rotating one does not rotate the other.
C. Right: Correct. Related multi-Region keys share the same key material and key ID, so the replica in eu-central-1 can decrypt ciphertext produced with the primary without calling eu-west-1. Rotating the primary key also rotates the key material of its replicas.
D. Wrong: S3 still encrypts the copy at rest, but the backup data leaves the customer managed key and its key policy. The extra copy process also adds work and drops the key control the team relies on.
Explanation
Multi-Region KMS keys let a replica in the recovery Region decrypt ciphertext from the primary with no cross-Region call, and rotation of the primary carries to the replica. A single-Region key keeps the dependency, a re-encryption job is ruled out, and an SSE-S3 copy gives up the customer managed key.
Want more on Encryption at rest, key policies and post-quantum cryptography (AWS KMS)? The 5 full-length practice sets have 10 more Encryption at rest, key policies and post-quantum cryptography (AWS KMS) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →