AWS Certified Solutions Architect Data Encryption with KMS 2 — Questions and Answers
Question 1: A company wants to encrypt S3 objects so that only specific IAM roles can decrypt them, even if someone gains S3 bucket access. Which KMS feature best satisfies this requirement?
- S3 default encryption with SSE-S3
- SSE-KMS with a customer managed key and a restrictive key policy (Correct answer)
- S3 Object Lock in compliance mode
- SSE-C with a client-provided key
Correct answer: SSE-KMS with a customer managed key and a restrictive key policy
SSE-KMS with a customer managed key lets you attach a key policy that explicitly lists which IAM principals can use kms:Decrypt, independent of S3 bucket permissions.
Question 2: Which KMS key type allows you to import your own key material generated outside of AWS?
- AWS managed key
- Customer managed key with imported key material (Correct answer)
- AWS owned key
- Data key
Correct answer: Customer managed key with imported key material
Customer managed keys support importing external key material, giving you full control over the cryptographic material while AWS manages the key infrastructure.
Question 3: An architect needs to encrypt data at rest in RDS using KMS. What happens to the automated backups when the RDS instance uses KMS encryption?
- Backups are stored unencrypted to reduce cost
- Backups are encrypted with the same KMS key as the RDS instance (Correct answer)
- Backups use a separate AWS managed key automatically
- Backups must be encrypted manually after creation
Correct answer: Backups are encrypted with the same KMS key as the RDS instance
RDS automated backups, snapshots, and read replicas inherit the same KMS key used to encrypt the source RDS instance.
Question 4: A Lambda function needs to decrypt a secret stored in AWS Secrets Manager. The secret is encrypted with a customer managed KMS key. What permission must the Lambda execution role have?
- secretsmanager:GetSecretValue only
- kms:Decrypt and secretsmanager:GetSecretValue (Correct answer)
- kms:GenerateDataKey only
- iam:PassRole on the KMS key
Correct answer: kms:Decrypt and secretsmanager:GetSecretValue
The Lambda execution role needs secretsmanager:GetSecretValue to retrieve the secret and kms:Decrypt to decrypt the data key that protects the secret value.
Question 5: What is the maximum size of data that can be encrypted directly using a KMS CMK via the Encrypt API call?
- 1 MB
- 4 KB (Correct answer)
- 256 KB
- 64 KB
Correct answer: 4 KB
KMS limits direct encryption via the Encrypt API to 4 KB; larger data must be encrypted using envelope encryption with a generated data key.
Question 6: A solutions architect wants to ensure that a KMS key is never used for encryption after a specific date. Which approach is most appropriate?
- Delete the KMS key immediately
- Set the key's key policy to deny all actions after the date using a Condition
- Disable the KMS key on the target date (Correct answer)
- Rotate the key and discard the old version
Correct answer: Disable the KMS key on the target date
Disabling a KMS key prevents any new encrypt or decrypt operations while preserving the ability to re-enable it, which is safer and reversible compared to deletion.
Question 7: When using SSE-KMS to encrypt an S3 object, which API call does S3 make to KMS on behalf of the requester during a PutObject operation?
- kms:Decrypt
- kms:GenerateDataKey (Correct answer)
- kms:ReEncrypt
- kms:CreateKey
Correct answer: kms:GenerateDataKey
S3 calls kms:GenerateDataKey to get a plaintext data key and an encrypted copy; S3 uses the plaintext key to encrypt the object, then discards it and stores only the encrypted key.
AWS Certified Solutions Architect Data Encryption with KMS 2
A company wants to encrypt S3 objects so that only specific IAM roles can decrypt them, even if someone gains S3 bucket access.
Which KMS feature best satisfies this requirement?