SAA-C03 Q210 · Security

Question

A company uses Amazon EC2 instances and stores data on Amazon Elastic Block Store (Amazon EBS) volumes. The company must ensure that all data is encrypted at rest by using AWS Key Management Service (AWS KMS). The company must be able to control rotation of the encryption keys. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

**Answer A: Create a customer managed key (CMK) and use it to encrypt EBS volumes.**

Let's check each requirement:

1. **Encrypt all data at rest**: ✅ Customer managed keys can encrypt EBS volumes at rest using AES-256 encryption.

2. **Use AWS KMS**: ✅ Customer managed keys are created and managed within AWS KMS.

3. **Control rotation of encryption keys**: ✅ Customer managed keys give you **full control over key rotation**. You can enable or disable automatic rotation (annually). You can also manually rotate by creating a new key and updating the alias — giving you complete flexibility.

4. **Least operational overhead**: ✅ Among all options that satisfy the 'control rotation' requirement, customer managed keys offer the best balance. You simply enable automatic rotation in the KMS cons

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips