SAA-C03 Q447 · Security

Question

A home security company is expanding globally and needs to encrypt customer data. The company does not want to manage encryption keys. The keys must be usable in multiple AWS Regions, and access to the keys must be controlled. Which solution meets these requirements with the least operational overhead?

Accepted Answer

**Answer A: AWS KMS multi-Region keys with ABAC condition keys**

Let's map each requirement to how this answer satisfies it:

1. **Encrypt customer data** → AWS KMS is a fully managed encryption service that integrates natively with dozens of AWS services (S3, EBS, RDS, etc.).

2. **Does not want to manage encryption keys** → AWS KMS is a **managed service**. AWS handles the durability, availability, and physical security of keys. You never touch the underlying key material.

3. **Keys must be usable in multiple AWS Regions** → **KMS multi-Region keys** are a native feature where a primary key in one Region can be replicated to other Regions. The replicated keys share the same key ID and key material, so ciphertext encrypted in one Region can be decrypted in another Region without cross-R

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips