A Company Has Decided to Use Encryption in Its AWS

question 240

Multiple Choice

A company has decided to use encryption in its AWS account to secure the objects in Amazon S3 using server-side encryption. Object sizes range from 16,000 B to 5 MB. The requirements are as follows: The key material must be generated and stored in a certified Federal Information Processing Standard (FIPS) 140-2 Level 3 machine. The key material must be available in multiple Regions. Which option meets these requirements?

• A) Use an AWS KMS customer managed key and store the key material in AWS with replication across Regions.
• B) Use an AWS customer managed key, import the key material into AWS KMS using in-house AWS CloudHSM, and store the key material securely in Amazon S3.
• C) Use an AWS KMS custom key store backed by AWS CloudHSM clusters, and copy backups across Regions.
• D) Use AWS CloudHSM to generate the key material and backup keys across Regions. Use the Java Cryptography Extension (JCE) and Public Key Cryptography Standards #11 (PKCS #11) encryption libraries to encrypt and decrypt the data.

---

Definitions:

Security Agreement

A legal contract that grants a lender a security interest in an asset or property offered as collateral for a loan.

Assigned

Transferred or allocated to a party or for a specific purpose.

Repossess

The act of taking back goods or property by a seller or lender from the buyer or borrower, usually due to failure to meet the terms of the sale or loan agreement.

Deficit

A financial situation where expenditures exceed revenue.