AWS KMS Key Management Quiz

1. The Decrypt operation in KMS returns plaintext only if the caller has permission. True or False?

True

False

2. What is the primary benefit of using KMS instead of managing encryption keys manually?

Lower data transfer costs

Centralized key management, compliance, and audit logging

Faster network connectivity

Automatic database backups

Submit

4. A KMS key in 'Disabled' state cannot be used for encryption or decryption operations. True or False?

True

False

5. Which KMS feature helps you audit key usage and detect suspicious activity?

CloudTrail integration

S3 versioning

VPC Flow Logs

Security Groups

6. What does the GenerateDataKey operation return?

Only the encrypted data key

Only the plaintext data key

Both plaintext and encrypted versions of the data key

A master key suitable for encryption

7. KMS grants allow you to delegate key usage permissions. Grants can be created and retired by authorized users. True or False?

True

False

8. What is the main advantage of envelope encryption?

It eliminates the need for encryption keys

It encrypts data using a data key and protects that key with a master key

It allows plaintext transmission of sensitive data

It reduces storage requirements by removing encryption

9. Which AWS service provides the AWS Encryption SDK for envelope encryption?

AWS CloudHSM

AWS KMS

AWS Secrets Manager

AWS Certificate Manager

10. What is data key caching used for in KMS?

Temporarily storing plaintext data keys locally to reduce API calls

Permanently storing encryption keys in memory

Backing up master keys across regions

Compressing encrypted data for storage

11. What is the primary purpose of AWS Key Management Service (KMS)?

Manage and control cryptographic keys for data encryption

Store database credentials and secrets

Monitor network traffic and intrusion detection

Perform automated security assessments

12. What is the Encrypt operation in KMS used for?

Encrypting plaintext data using a KMS key

Rotating encryption keys

Deleting encrypted data

Generating new cryptographic keys

13. Which statement about KMS key policies is correct?

Key policies are optional for customer-managed keys

Key policies use the same format as IAM policies

Key policies cannot grant permissions to IAM users

Key policies override all IAM policies automatically

14. What is the primary function of a KMS key policy?

Define which AWS principals can use and manage the key

Encrypt data stored in S3 buckets

Monitor KMS API calls and usage

Automatically delete keys after 30 days

Submit

16. What does key rotation in KMS help prevent?

Unauthorized key deletion

Exposure of keys that may be compromised

Network latency issues

Cross-region replication failures

17. Which key type must you create and manage yourself in KMS?

AWS-managed keys

Customer-managed keys

Default KMS keys

AWS-owned keys

18. AWS-managed keys are created and managed by AWS. True or False?

True

False

19. What is a Customer Master Key (CMK) in AWS KMS?

A key used only for SSH access to EC2

A logical representation of a master key used for encryption/decryption

A default key provided by AWS for all accounts

A temporary key that expires after 24 hours

20. Which AWS service does KMS integrate with to encrypt data at rest by default?

EC2 instances

S3 buckets

VPC subnets

Security groups

AWS Security Specialty KMS Key Management Quiz

1. The Decrypt operation in KMS returns plaintext only if the caller has permission. True or False?

2.

What first name or nickname would you like us to use?

2. What is the primary benefit of using KMS instead of managing encryption keys manually?

3. When you schedule key deletion in KMS, the minimum waiting period is ____ days.

4. A KMS key in 'Disabled' state cannot be used for encryption or decryption operations. True or False?

5. Which KMS feature helps you audit key usage and detect suspicious activity?

6. What does the GenerateDataKey operation return?

7. KMS grants allow you to delegate key usage permissions. Grants can be created and retired by authorized users. True or False?

8. What is the main advantage of envelope encryption?

9. Which AWS service provides the AWS Encryption SDK for envelope encryption?

10. What is data key caching used for in KMS?

11. What is the primary purpose of AWS Key Management Service (KMS)?

12. What is the Encrypt operation in KMS used for?

13. Which statement about KMS key policies is correct?

14. What is the primary function of a KMS key policy?

15. KMS supports automatic key rotation. Rotation occurs every ____ year(s).

16. What does key rotation in KMS help prevent?

17. Which key type must you create and manage yourself in KMS?

18. AWS-managed keys are created and managed by AWS. True or False?

19. What is a Customer Master Key (CMK) in AWS KMS?

20. Which AWS service does KMS integrate with to encrypt data at rest by default?