Encryption & Key Management

KMS key policies, envelope encryption, CloudHSM, and secrets management.

Domain 5: Data Protection · 18% of exam · 2 questions

Question 1 of 2 · keys: 1–5 select, Enter submit, ← → navigate

Domain 5: Data ProtectionEncryption & Key ManagementmediumSingle choice

An application encrypts large volumes of data. KMS has a 4 KB limit per Encrypt call. How does KMS handle encryption of larger data?

KMS automatically splits data into 4 KB chunksEnvelope encryption — KMS generates a data key that encrypts the data locally, and encrypts only that keyStream the data through KMS in batchesUpload data to KMS-managed S3 storage