AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 225

Question

A company’s engineering team is developing a new application that creates AWS Key Management Service (AWS KMS) customer managed key grants for users. Immediately after a grant is created, users must be able to use the KMS key to encrypt a 512-byte payload. During load testing, AccessDeniedException errors occur occasionally when a user first attempts to use the key to encrypt. Which solution should the company’s security specialist recommend to eliminate these AccessDeniedException errors?

Accepted Answer

Correct answer: D. The correct answer is D. Option D: Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. Instruct users to use that grant token in their call to encrypt.

AWS Certified Security - Specialty SCS-C02 — Question 225