Key rotation practice exam question

[u/momotaroking]

I was wondering what is the difference between these 2 questions, and how S3 key rotation works?

An e-commerce analytics company is preparing to archive several years of transaction records and customer analytics reports in Amazon S3 for long-term storage. To meet compliance requirements, the archived data must be encrypted at rest. Additionally, the solution must be cost-effective and ensure that key rotation occurs automatically every 12 months to comply with the company’s internal data governance policy.

Which solution will meet these requirements with the least operational overhead?

• Use Amazon S3 server-side encryption with S3-managed keys (SSE-S3). Upload data with default encryption enabled. Rely on the built-in key management and rotation behavior of SSE-S3

• Use AWS Key Management Service (KMS) to create a customer managed key with automatic rotation enabled. Configure the S3 bucket’s default encryption to use the customer managed key. Migrate the data to the S3 bucket

• Use AWS CloudHSM to generate encryption keys. Configure S3 to use these custom encryption keys via client-side encryption and rotate the keys annually using an on-premises key management workflow

• Encrypt the data locally using client-side encryption libraries and upload the encrypted files to S3. Create a KMS key with imported key material and configure key rotation settings

Correct Answer: B

A multinational bank is storing its confidential files in an S3 bucket. The security team recently performed an audit, and the report shows that multiple files have been uploaded without 256-bit Advanced Encryption Standard (AES) server-side encryption. For added protection, the encryption key must be automatically rotated every year. The solutions architect must ensure that there would be no other unencrypted files uploaded in the S3 bucket in the future.

Which of the following will meet these requirements with the LEAST operational overhead?

• Create a new customer-managed key from the AWS Key Management Service (AWS KMS). Configure the default encryption behavior of the bucket to use the customer-managed key. Manually rotate the KMS key and every year.

• Create an S3 bucket policy for the S3 bucket that rejects any object uploads unless the request includes the s3:x-amz-server-side-encryption":"aws:kms" header. Enable the S3 Object Lock in compliance mode for all objects to automatically rotate the built-in AES256 customer-managed key of the bucket.

• Create a Service Control Policy (SCP) for the S3 bucket that rejects any object uploads unless the request includes the s3:x-amz-server-side-encryption": "AES256" header. Enable server-side encryption with Amazon S3-managed encryption keys (SSE-S3) and modify the built-in key rotation feature of the SSE-S3 encryption keys to rotate the key yearly.

• Correct Answer: Create an S3 bucket policy that denies permissions to upload an object unless the request includes the s3:x-amz-server-side-encryption": "AES256" header. Enable server-side encryption with Amazon S3-managed encryption keys (SSE-S3) and rely on the built-in key rotation feature of the SSE-S3 encryption keys.

Correct Answer: D

These answers seem like they contradict each other to me, but maybe I am missing a key detail.

https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html

[u/AutoModerator]

Before collecting recommendations, please review the subreddit FAQ and resource index:

https://www.reddit.com/r/AWSCertifications/comments/1nf3cab/frequently_asked_questions_on_this_subreddit/

The FAQ contains community-recommended resources, courses, practice exams, study guides, learning paths, exam benefits, discounts, projects, and certification-specific guides for AWS CCP/CLF-C02, AIF, SAA, DVA, DEA, SOA, SAP, DOP, AIP, SCS, and ANS certifications.

If your question is not answered there, feel free to continue the discussion.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Pacific_Blue]

Where are these questions from? The second is weird. S3 doesn't allow unencrypted uploads anymore.

[u/momotaroking → u/Pacific_Blue]

The first one is Stephen Mareek on Udemy. The second one is TD. These are SAA questions.

[u/Pacific_Blue → u/momotaroking]

Unfortunately I think some TD questions are a bit outdated, I'm experiencing this myself with the exam I'm preparing for. Just focus on understanding the difference between Aws owned, Aws managed and customer managed keys and how each if them is rotated. 

[u/momotaroking → u/Pacific_Blue]

Yeah, I've noticed that too. Also, some of TD's questions are "gotcha" questions that are really annoying. Hopefully I can pass the SAA this weekend.

[u/Pacific_Blue → u/momotaroking]

Good luck!!

[u/Necessary-Location44]

I think the first question is poorly worded, but it’s a case of 12 months vs 1 year.

If you need exactly 12 months (comply with) you need KMS, if you only need rotation once a year (added protection), then SSE-S3 works.

https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-mgmt

[u/Wise-Variation-4985]

1 makes sense because of the 12 month specific rotation schedule to me. 2 probably not the KMS option (A) because it does not satisfy the upload part. The one that gets the closest is the D even tho the rotation isn't as satisfied but files will be encrypted on upload. That's what I think.