5.1Standard
Encrypt training data and logs in S3.
Limit who can use and manage the keys.
Choose two appropriate practices.
× Incorrect
Restrict KMS-key use to required roles and define rotation, disable, deletion, and audit procedures.
Detailed explanation
IncorrectGive everyone KMS administrator permissions
Misuse, deletion, or disclosure impact is large.
IncorrectEncryption removes the need for IAM and key management
The key itself must be protected.
CorrectLimit KMS-key use to data owners and required execution roles
Only necessary principals can decrypt.
CorrectDefine key rotation, disable, deletion, and audit procedures
The key lifecycle and incident response are controlled.
Check official documentation
Compare the following points with the official documentation.
AWS公式KMS・IAMとAIF-C01 Domain 5.1の保存データ保護を確認する。
Official references
What to confirm
暗号化と鍵・IAM・監査を一体で設計できる。
Key points
- KMS
- Key permissions
- Rotation
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
AWS KMS
A service for creating, protecting, using, rotating, and auditing cryptographic keys.
Key policy
A resource policy that defines who may administer or use a KMS key and under which conditions.
Question IDAWS-AIF-169
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue