AWS Certified Solutions Architect – Professional — Question 439
You are designing a personal document-archiving solution for your global enterprise with thousands of employees. Each employee has potentially gigabytes of data to be backed up in this archiving solution. The solution will be exposed to the employees as an application, where they can just drag and drop their files to the archiving system. Employees can retrieve their archives through a web interface. The corporate network has high bandwidth AWS Direct Connect connectivity to
AWS.
You have a regulatory requirement that all data needs to be encrypted before being uploaded to the cloud.
How do you implement this in a highly available and cost-efficient way?
Answer options
- A. Manage encryption keys on-premises in an encrypted relational database. Set up an on-premises server with sufficient storage to temporarily store files, and then upload them to Amazon S3, providing a client-side master key.
- B. Mange encryption keys in a Hardware Security Module (HSM) appliance on-premises serve r with sufficient storage to temporarily store, encrypt, and upload files directly into Amazon Glacier.
- C. Manage encryption keys in Amazon Key Management Service (KMS), upload to Amazon Simple Storage Service (S3) with client-side encryption using a KMS customer master key ID, and configure Amazon S3 lifecycle policies to store each object using the Amazon Glacier storage tier.
- D. Manage encryption keys in an AWS CloudHSM appliance. Encrypt files prior to uploading on the employee desktop, and then upload directly into Amazon Glacier.
Correct answer: C
Explanation
Option C is correct because managing keys in Amazon KMS and using S3 client-side encryption ensures that files are encrypted before upload, meeting the security requirement while leveraging fully managed, highly available services. Utilizing S3 lifecycle policies to transition archived data to the Amazon Glacier tier provides the most cost-efficient storage strategy. Options A and B introduce on-premises hardware and servers that reduce high availability and increase administrative overhead, while Option D is cost-prohibitive due to AWS CloudHSM fees and adds complexity by trying to upload directly to Glacier from desktops.