A security engineer must enable seamless encryption of Amazon S3 objects without requiring users to manage encryption keys directly. The solution must scale with minimal ongoing management, and the organization must be able to immediately revoke and delete the encryption keys. Which approach meets these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Use AWS KMS with imported key material and call DeleteImportedKeyMaterial to immediately revoke and remove the key material if needed..
Why this is the answer
Using AWS KMS with imported key material allows for immediate revocation and deletion of encryption keys via DeleteImportedKeyMaterial. This meets the requirement for immediate key removal and seamless S3 encryption without direct user key management, as KMS handles the encryption process. AWS managed keys (KMS) cannot be immediately deleted; ScheduleKeyDeletion has a minimum PendingWindowInDays of 7 days, failing the immediate revocation requirement. AWS CloudHSM offers strong key management but requires more operational overhead for key deletion and doesn't integrate as seamlessly with S3 encryption as KMS. Storing keys in AWS Systems Manager Parameter Store is not a secure or scalable solution for S3 object encryption and lacks the immediate revocation capabilities of KMS.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed