Practice Test 1 | AWS Certified Solutions Architect Associate | SAA-C03 | Dumps | Mock Test

Question 38

A company is using a Redshift cluster to store its data warehouse. There is a requirement from the Internal IT Security team to encrypt data in the Redshift database. How could this be achieved? (SELECT TWO)

A. Encrypt the EBS volumes of the underlying EC2 Instances.

B. Use AWS KMS Customer Default master key.

C. Use SSL/TLS for encrypting the data.

D. Use hardware security module (HSM) to manage the top-level encryption keys .

Answer

Explanation:

Correct Answer – B and D

AWS documentation mentions the following:

Amazon Redshift uses a hierarchy of encryption keys to encrypt the database. You can use either AWS Key Management Service (AWS KMS) or a hardware security module (HSM) to manage the top-level encryption keys in this hierarchy. The process that Amazon Redshift uses for encryption differs depending on how you manage keys.

Option D is correct. We can use the hardware security module (HSM) to manage the top-level encryption keys for key management with Amazon Redshift.

Reference:

https://aws.amazon.com/blogs/big-data/encrypt-your-amazon-redshift-loads-with-amazon-s3-and-aws-kms/

https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html