Security World 3 · Lock and Key · Stage 2

Whose Key Is It

Four workloads, four kinds of key: who generated the material, where it lives, in how many Regions, and how it rotates.

Domain: Security
World: Security World 3: Lock and Key (Professional)
Game type: Policy stepper: Edit identity, resource and key policies; the matrix shows the gate that decided.
Time: About 30 minutes on a first attempt (estimated)
Exam guides: SAA-C03Task 1.3: Determine appropriate data security controls
SAP-C02Task 1.2: Prescribe security controls
SCS-C03Skill 5.3.2: Manage and use imported key material (for example, by managing and rotating imported key material, by managing and configuring external key stores); Skill 5.3.3: Describe the differences between imported key material and AWS generated key material; Skill 5.3.5: Create and manage encryption keys and certificates across a single AWS Region or multiple Regions (for example, AWS KMS customer managed AWS KMS keys, AWS Private Certificate Authority); Skill 5.2.1: Design, implement, and configure data encryption at rest based on specific requirements (for example, by selecting the appropriate encryption key service such as AWS CloudHSM or AWS KMS or by selecting the appropriate encryption type such as client-side encryption or server-side encryption)