CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding AWS Encryption with KMS
Learn why AWS Key Management Service is essential for managing encryption of sensitive data at rest. Explore the exam question breakdown.
A common challenge in the AWS Certified Solutions Architect - Associate exam is choosing the right service for data encryption. Candidates often confuse services designed for security with those focused on data management. Knowing the purpose of each service is crucial.
The question
A company is designing a web application that will collect sensitive user data. They need to ensure that data is encrypted both at rest and in transit. What AWS service should they use to manage encryption of data at rest?
- A. AWS Shield
- B. AWS Key Management Service (KMS)
- C. AWS CloudTrail
- D. AWS WAF
Think before you scroll
Consider what each service is designed to do. Focus on services that handle encryption and data protection, rather than those that provide logging or DDoS protection.
The answer
The correct option is B. AWS Key Management Service (KMS). KMS is specifically designed to manage encryption keys for data stored in AWS, making it the right choice for encrypting data at rest.
Why the other options lose
- A. AWS Shield: This service is designed to protect against DDoS attacks. While it enhances security, it does not manage encryption for data at rest.
- C. AWS CloudTrail: CloudTrail is primarily used for logging API calls made within your AWS account. Although it plays an important role in security monitoring, it does not handle encryption.
- D. AWS WAF: The Web Application Firewall (WAF) protects web applications from common web exploits. Like Shield, it focuses on security but does not manage encryption of data.
The concept behind it
Understanding the purpose of AWS services is key. KMS is central to managing encryption keys for data at rest. When designing secure architectures, always align the service capabilities with your security requirements.
Exam trap to remember
Remember: KMS is your go-to for encryption management at rest. Don't confuse it with services focused on logging or traffic protection.