A developer must encrypt files locally (outside AWS) using symmetric encryption inside the application before uploading them to an Amazon S3 bucket. Which approach satisfies these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Generate a data key with AWS Key Management Service (AWS KMS). Use the AWS Encryption SDK in the application to encrypt the files..
Why this is the answer
The correct approach is to generate a data key with AWS KMS and use the AWS Encryption SDK. AWS KMS provides secure generation and management of cryptographic keys. The AWS Encryption SDK simplifies client-side encryption by handling the key management and encryption/decryption processes, including using data keys from KMS for symmetric encryption. This meets the requirement for local, symmetric encryption within the application. Generating an HMAC key is for message authentication, not data encryption. Using the AWS CLI to encrypt files would not meet the requirement of encrypting inside the application. Generating a data key pair is for asymmetric encryption, but the requirement specifies symmetric encryption.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed