DVA-C02 Exam - Question 260

Question

A developer is writing an application that will retrieve sensitive data from a third-party system. The application will format the data into a PDF file. The PDF file could be more than 1 MB. The application will encrypt the data to disk by using AWS Key Management Service (AWS KMS). The application will decrypt the file when a user requests to download it. The retrieval and formatting portions of the application are complete.

The developer needs to use the GenerateDataKey API to encrypt the PDF file so that the PDF file can be decrypted later. The developer needs to use an AWS KMS symmetric customer managed key for encryption.

Which solutions will meet these requirements?

Examice · Accepted Answer

To encrypt the PDF file and be able to decrypt it later, the developer should write the encrypted key from the GenerateDataKey API to disk for later use. The plaintext key from the GenerateDataKey API should be used along with a symmetric encryption algorithm to encrypt the file. This method ensures that the decryption process can be securely managed while keeping the plaintext key more transient and only used in-memory.

CrescentShared · Answer

Using the KMS Encrypt API to encrypt large amounts of data, such as a PDF file that could be more than 1 MB, is not efficient and can be costly. AWS KMS is designed for encrypting small amounts of data, such as encryption keys or short strings. For larger data, it's recommended to use a client-side encryption library with a data key generated by KMS.

KarBiswa · Answer

https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html

SerialiDr · Answer

Option A is the most appropriate method for encrypting a PDF file using AWS KMS, where the plaintext key is used for encryption operations, and the encrypted key (not the plaintext key) is stored or managed externally for later decryption use.

ANDRES715 · Answer

Según la documentación de AWS, cuando se utiliza la API GenerateDataKey, se obtiene una clave de texto sin formato y una clave cifrada. La clave de texto sin formato se puede escribir en el disco para su uso posterior, mientras que la clave cifrada se utiliza para cifrar los datos. En este caso, el desarrollador debe escribir la clave de texto sin formato en el disco para su uso posterior y utilizar la clave cifrada para cifrar el archivo PDF mediante la API de cifrado KMS.

Abdullah22 · Answer

going with C

DeaconStJohn · Answer

Going with my gut.

65703c1 · Answer

A is the correct answer.

jyrajan69 · Answer

The question clearly says using KMS so why would you even consider A and B

DVA-C02 Exam - Question 260

Discussion