Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
For client-side encryption, especially when using the AWS SDK with KMS, the client performs the following steps: Requests a data key from KMS via kms:GenerateDataKey Uses the plaintext key to encrypt the object Stores the encrypted key and the encrypted object in S3 Thus, kms:GenerateDataKey is essential for enabling the client to encrypt before uploading.
The answers don't make sense. The requirement is that it will be client-side encryption, which means the object is already encrypted when sent to S3. S3 will not do any encryption, so S3 does not need to access the KMS key,
A = correct (you encrypt data with KMS Data Key and not KMS Key directly, unless data is < 4K) B = getting the policy would allow to get the data key needed for encryption C = client side encryption uses symmetric key not asymmetric keys D = sign allows for signing messages, API calls, etc.