Day 5 - Week 9 Comprehensive Review: How Keywords Point to Answers

Over the past week, we've surveyed the full terrain of security and encryption—from KMS key isolation through GuardDuty, Inspector, Macie, and Security Hub's detection divisions. On the exam, problems in this domain almost always follow the pattern: "one or two keywords in the scenario point to the answer." If you see "decryption across regions," think Multi-Region Key. If "automatic rotation" appears, think Secrets Manager. If "detect threats without agents," think GuardDuty. This article solidifies that keyword-to-answer mapping in one sweep.

The core of review is not memorization, but grasping why each answer is correct. KMS limits itself to 4KB not randomly, but because Envelope Encryption forces a design that doesn't expose the master key to large data. Key Policy takes precedence over IAM not as arbitrary hierarchy, but because limiting blast radius—if one key is compromised, not everything leaks—is a design principle. Understand the "why" and you solve novel variations. Below, one-line summaries and comparison tables build the skeleton; 12 scenario problems add the flesh.

Week 9 Core Concepts: One-Line Summary

1. KMS Key Types — AWS Owned (free, invisible) / AWS Managed (aws/ prefix, forced rotation) / Customer Managed ($1/month, policy & rotation control). Key material never downloadable.
2. Envelope Encryption — Bypass KMS's 4KB limit. Get DEK via GenerateDataKey, encrypt data locally, store encrypted DEK with data. Plaintext DEK exists in memory only.
3. Key Policy Takes Precedence — Even with kms:* in IAM, Key Policy must delegate or deny. Remove the root delegation line from default policy and the key locks.
4. Key Rotation — Auto-rotation adds backing keys only; Key ID unchanged. Preventive, not breach response.
5. Key Deletion — 7–30 day wait mandatory. Permanent decryption loss risk. Pre-test with disable first.
6. Multi-Region Key — Only path for cross-region decryption. Required for Global Table, S3 CRR (SSE-KMS).
7. Encryption Context — Works as AAD. Decrypt requires exact match. First suspect when permissions are correct but decryption fails.
8. Secrets Manager vs Parameter Store — Auto-rotation + Cross-Region: Secrets Manager only. Parameter Store: plain settings, free.
9. IAM Access Analyzer — Auto-detects exposure outside Zone of Trust + CloudTrail 90-day data for least-privilege policy generation.
10. GuardDuty (behavior/threat) + Inspector (software/vulnerability) + Macie (data/sensitive) + Security Hub (aggregation/standard) — Each tool sees a different layer.
11. CloudHSM — Dedicated HSM, FIPS 140-2 L3, AWS has no key access. Only when regulation mandates it.
12. Auto-Response Skeleton — Security tool → EventBridge → Lambda/SSM Automation. Polling is wrong.

💡 Related Theory: One principle threads through all 12 concepts: "Defense in Depth." Don't rely on a single control; build multiple independent defensive layers so if one fails, the next holds. Military strategy roots this concept. KMS Key Policy (separate line of defense even if IAM is breached), Envelope Encryption (minimize master key exposure), deletion waiting period (human error brakes), four detection tools at different layers (behavior/software/data/configuration each watched separately)—all embody this principle. On the exam, "most secure configuration" questions usually reward "add one more layer" answers.

Comparison Tables: Common Confusion Points

KMS vs CloudHSM

Parameter Store vs Secrets Manager

Four Detection Tools

🔍 Deeper Dive: When memorizing comparison tables, attach "why is this different?" and you become resistant to variation questions. Example: only Secrets Manager supports auto-rotation because it orchestrates a 4-step lifecycle (createSecret → setSecret → testSecret → finishSecret) via Lambda; Parameter Store is a simple key-value store with no orchestration concept. Only Macie bills by data bytes because it's the only tool reading object body (others see metadata), making large-scale scan cost control a Macie-specific exam point.

⚠️ Pitfall: Two frequent confusion points in comparison tables. First: "rotate DB password free and automatic" is a contradiction answer—auto-rotation is Secrets Manager only ($0.40/month), so if "free" and "auto-rotation" sit together in one choice, it's wrong. Second: tool layer substitution like "GuardDuty scans OS vulnerabilities" or "Inspector detects malicious domain communication"—these swap tool responsibilities. GuardDuty watches behavior, Inspector watches software. Answers blurring this boundary are frequent traps.

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

An IAM user has kms:* permission yet a specific KMS key denies with AccessDenied. Most likely cause?

• AIAM policy has MFA condition (aws:MultiFactorAuthPresent) but session lacks MFA
• BKey Policy doesn't delegate to this account/principal—KMS Key Policy (resource-based) beats IAM
• CKey is in another region; endpoint mismatch prevents find; cross-region keys don't auto-route
• DHit kms:RequestAlias quota or per-second API limit; ThrottlingException blocks

Question 2

Encrypting a 1GB log file with KMS hits a 4KB limit error. Standard fix?

• ASplit file into 4KB chunks, call Encrypt API per chunk, concatenate results
• BEnvelope Encryption—GenerateDataKey for DEK, encrypt file locally, store encrypted DEK with data
• CUse CloudHSM cluster instead; send 1GB to HSM directly in one call
• DAdd SSE enforcement rule to S3 bucket policy to bypass the 4KB limit

Question 3

Auto-rotate RDS MySQL master password every 30 days without writing rotation Lambda. Best approach?

• AParameter Store SecureString + EventBridge schedule running monthly password polling Lambda
• BSecrets Manager + AWS-provided RDS Rotation Lambda (blueprint)
• CCustom Lambda on cron; ALTER USER monthly to change password
• DEnable KMS auto key rotation (annual backing key swap) so password rotates automatically

Question 4

During Secrets Manager's RDS password rotation, running apps must not see auth failures. What mechanism enables zero-downtime?

• ADB switches to read-only during rotation
• BRotation's 4-step flow (createSecret→setSecret→testSecret→finishSecret) creates new secret under AWSPENDING label, sets it in DB, validates it, then moves AWSPENDING→AWSCURRENT label only after validation passes
• CApps restart at rotation time
• DUse two passwords simultaneously

Question 5

Seoul-region data replicates to Tokyo via S3 CRR with SSE-KMS encryption. Destination decryption requires?

• AUse Seoul KMS key directly from Tokyo
• BMulti-Region Key—primary (Seoul) and replica (Tokyo) share key ID and backing material; both regions decrypt
• CCreate independent Tokyo KMS key; disable replication
• DSwitch to CloudHSM dedicated cluster

Question 6

Operator concludes a KMS key is unused and deletes it. Minimize permanent data loss. Best procedure?

• ACall schedule-key-deletion immediately
• BFirst disable key (immediately reversible); run operationally for days/weeks, CloudWatch-monitor for zero decryption attempts; then schedule deletion
• CRemove all permissions from Key Policy
• DDelete only the alias

Question 7

Permissions, key state, region all correct yet a ciphertext decrypts with InvalidCiphertext. After permissions, suspect #1?

• AKey rotation in progress; temporary block
• BEncryption Context mismatch—Encryption Context must match exactly between encrypt and decrypt
• CNot a Multi-Region Key
• DDEK expired

Question 8

EC2 instance communicates with known C&C domain. Detect without agents. Which tool and why?

• AInspector—scans OS vulnerabilities
• BGuardDuty—analyzes Flow Logs/CloudTrail/DNS Logs; Threat Intel Backdoor:EC2/C&CActivity.B!DNS finding auto-generated
• CMacie—scans S3 data
• DConfig—tracks config changes

Question 9

Inspector v2 running on ECR a month. Clean image last week; today Critical finding appears; image unchanged. Correct interpretation?

• AImage was tampered with
• BNew CVE published to NVD; Inspector v2's continuous scan auto-re-evaluates old resources—expected behavior
• CInspector bug; ignore finding
• DRe-push image to refresh scan

Question 10

80TB S3 data lake; find cards/SSNs but control scan costs. Best approach?

• AMacie full 80TB precision scan at once
• BMacie auto-sensitive-data-discovery (sampling) maps risky buckets cheaply; then precision-scan high-risk only
• CGuardDuty scan S3
• DInspector scan S3

Question 11

Company wants all-member-account GuardDuty/Inspector/Macie/Access Analyzer/third-party findings on one dashboard, identical format, and auto-score CIS·PCI-DSS compliance. Which service and prerequisite?

• ACloudWatch Dashboard
• BSecurity Hub—ASFF normalizes all findings, auto-scores standards. Standards use Config Rules internally; Config must be enabled
• CAudit Manager
• DConfig alone

Question 12

GuardDuty detects severity 8.2 suspicious instance. Auto-respond: immediately swap to isolation SG, no human touch. AWS standard flow?

• ALambda polls GuardDuty every minute for findings
• BGuardDuty Finding → EventBridge Rule (severity ≥ 7.0 filter) → SSM Automation Runbook AWS-IsolateEC2InstanceFromGuardDutyFinding(or Lambda) swaps SG
• CConfig Rule auto-terminates instance
• DInspector auto-patches instance

Next Week Preview (Week 10)

Week 10: Backup & DR Operations—Snapshot, AWS Backup, Multi-AZ, Cross-Region.

• Day 1: EBS Snapshot, AMI, DLM (Data Lifecycle Manager)
• Day 2: AWS Backup—Plan, Vault, Cross-Region/Cross-Account
• Day 3: RDS Multi-AZ vs Read Replica, Aurora Global DB
• Day 4: S3 Replication (CRR/SRR), Storage Gateway, Elastic Disaster Recovery
• Day 5: Week 10 review + 10 scenario problems

💡 Reliability & BCP domain (16%). RTO/RPO scenarios frequent; "time to recover vs point in time" trade-off is a perennial exam point.