AWS Certified Security – Specialty (SCS-C02) — Question 225

A company’s engineering team is developing a new application that creates AWS Key Management Service (AWS KMS) customer managed key grants for users. Immediately after a grant is created, users must be able to use the KMS key to encrypt a 512-byte payload. During load testing, AccessDeniedException errors occur occasionally when a user first attempts to use the key to encrypt.

Which solution should the company’s security specialist recommend to eliminate these AccessDeniedException errors?

Answer options

• A. Instruct users to implement a retry mechanism every 2 minutes until the call succeeds.
• B. Instruct the engineering team to consume a random grant token from users and to call the CreateGrant operation by passing the grant token to the operation. Instruct users to use that grant token in their call to encrypt.
• C. Instruct the engineering team to create a random name for the grant when calling the CreateGrant operation. Return the name to the users and instruct them to provide the name as the grant token in the call to encrypt.
• D. Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. Instruct users to use that grant token in their call to encrypt.

Correct answer: D

Explanation

The correct answer is D because it ensures that users are using the grant token that was specifically issued to them in the CreateGrant response, which provides them the necessary permissions to encrypt successfully. Options A and B do not directly address the timing and permissions issue, while option C introduces unnecessary complexity without resolving the underlying problem.