CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Walkthrough: AWS Certified Security - Specialty (SCS-C02) Encryption Keys Question
Explore a key question from the AWS Certified Security - Specialty exam and learn how to choose the right AWS service for managing encryption keys.
Choosing the right AWS service for encryption key management can trip up candidates. This question tests your understanding of AWS services and their specific functions.
The question
A security engineer is tasked with ensuring that all personal identifiable information (PII) stored in an Amazon RDS database is encrypted. Which AWS service should the engineer use to manage the encryption keys for this data?
- A. AWS Secrets Manager
- B. AWS Key Management Service (KMS)
- C. AWS CloudHSM
- D. Amazon Macie
Think before you scroll
Consider the specific functionalities of each service. Focus on which service is designed specifically for managing encryption keys and integrates well with RDS.
The answer
The correct option is B. AWS Key Management Service (KMS). KMS is built for managing encryption keys and is fully integrated with Amazon RDS, making it the most suitable choice for this scenario.
Why the other options lose
- A. AWS Secrets Manager: This service is intended for managing secrets, such as API keys and database credentials. It does not specifically manage encryption keys, making it unsuitable for this task.
- C. AWS CloudHSM: CloudHSM provides hardware security modules for key management but is more complex and not typically used for direct integration with RDS encryption. It is not the primary choice for managing encryption keys in this context.
- D. Amazon Macie: Macie is a security service focused on data discovery and data classification. It does not manage encryption keys, so it does not fit the requirements of this question.
The concept behind it
The principle to grasp here is that AWS services are designed for specific purposes. When tasked with encryption key management, KMS is the go-to service due to its integration and specialized functionality. Understanding each service’s role helps in making the correct choice.
Exam trap to remember
Remember: when it comes to managing encryption keys specifically, KMS is king. Always consider the primary function of the service in question.