Question
A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster.
The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys.
How can the security engineer meet these requirements?
- A. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon Athena.
- B. To create the keys, use Amazon S3 and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
- C. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon GuardDuty.
- D. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail. Correct
Explanation
The correct answer is D. AWS KMS can create symmetric encryption KMS keys in a custom key store backed by an AWS CloudHSM cluster, so the key material is generated and used inside the HSMs that the company controls. Those KMS keys can then generate symmetric data keys and data key pairs that the applications use locally. AWS CloudTrail records every AWS KMS API call that uses the keys, which meets the auditing requirement. Amazon Athena only queries data and Amazon GuardDuty is a threat detection service, so neither audits key use by itself, and Amazon S3 cannot create keys in a custom key store.
