Data Protection, Encryption and Secrets
Data security items test KMS, envelope encryption, S3 encryption, EBS and RDS encryption, Secrets Manager, Parameter Store, rotation, and data classification.
How to study for AWS Solutions Architect Associate
Treat each question as an architecture tradeoff: identify security boundaries, failure modes, performance needs, data paths, and cost constraints before choosing services.
Core concepts
Concept 1
Data Protection, Encryption and Secrets questions reward architecture tradeoff reasoning rather than picking the most familiar AWS service.
Exam cue: Identify the workload requirement, failure mode, data path, access boundary, and operational constraint.
Concept 2
The best answer maps requirements to security, resilience, performance, and cost constraints before choosing services.
Exam cue: Match the AWS service to the Well-Architected pillar the scenario is testing.
Concept 3
Eliminate answers that ignore shared responsibility, single points of failure, data movement, scaling behavior, or total cost.
Exam cue: Prefer managed, durable, least-privilege, multi-AZ, and right-sized designs when requirements call for them.
Risk pitfalls and guardrails
Choosing the most powerful service when a simpler managed service satisfies the requirement.
Guardrail: Avoid answers that use broad permissions, public data paths, single-AZ state, overbuilt compute, or commitment pricing without predictable usage.
Solving performance while ignoring security, availability, or cost constraints stated in the scenario.
Guardrail: Avoid answers that use broad permissions, public data paths, single-AZ state, overbuilt compute, or commitment pricing without predictable usage.
Assuming one Availability Zone, public access, or manual operations are acceptable without justification.
Guardrail: Avoid answers that use broad permissions, public data paths, single-AZ state, overbuilt compute, or commitment pricing without predictable usage.
Memory anchors
KMS
AWS KMS creates and controls cryptographic keys used by many AWS services.
Envelope Encryption
Envelope encryption protects data keys with a master key or KMS key.
S3 SSE
S3 server-side encryption protects objects at rest using managed or customer-controlled keys.
EBS Encryption
EBS encryption protects volumes, snapshots, and data moving between supported instances and volumes.
RDS Encryption
RDS encryption protects database storage, automated backups, read replicas, and snapshots where supported.
Secrets Manager
AWS Secrets Manager stores secrets and can support automatic rotation.
Parameter Store
Systems Manager Parameter Store stores configuration values and can store secure strings.
Key Policy
A key policy controls administrative and usage permissions for a KMS key.
Rotation
Secret or key rotation reduces risk from long-lived credentials.
Data Classification
Data classification identifies sensitivity so controls match protection requirements.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
A company must encrypt S3 objects with a customer controlled key and audit every key use. Security administrators need to change who may decrypt. Which option fits?
A high-volume S3 workload uses SSE-KMS and generates many KMS requests and costs. The company must retain SSE-KMS. Which feature can reduce direct KMS traffic?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”