What's changed: Deepened SCS-C02 Chapter 5 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
5.1KMS and Encryption
Understand at-rest encryption core—KMS, CMK (customer-managed keys), envelope encryption, key policies, key rotation, and CloudHSM. Manage keys securely and encrypt data.
KMS is central to data protection. Understand key management, access control, and encryption mechanics precisely.
5.1.1How KMS works
- Envelope encryption: a CMK encrypts a data key; data is encrypted by the data key.
- CMK types: AWS-managed and customer-managed (CMK); the latter controls policy/rotation.
- Access control: must be allowed by both the key policy AND IAM.
- CloudHSM: use for strict requirements needing FIPS 140-2 Level 3 / dedicated HSM.
Common on SCS-C02: key management/at-rest encryption = KMS, CMK encrypts data key = envelope encryption, KMS access = key policy + IAM, dedicated HSM/FIPS Level 3 = CloudHSM, automatic rotation. Note: without an explicit key-policy allow, even an IAM admin cannot use the key.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.