Training data must be encrypted with keys that you control. What do you use?
Why A is the answer
AWS KMS customer managed keys
KMS manages encryption keys.
In detail
- Customer managed keys in KMS are keys you control.
- You control the key policy.
Use case
An illustrative scenario, not a real incident.
A bank must control its encryption keys, so it uses AWS KMS customer managed keys.
See it in different ways
flowchart TD A["Secure ML workload"] --> B["VPC and private endpoints"] A --> C["Least-privilege IAM roles"] A --> D["KMS encryption at rest"] A --> E["TLS in transit"]
mindmap
root((Security))
Access
IAM execution role
Network
VPC interface endpoint
Data
KMS customer managed keys
Audit
CloudTrailflowchart LR S0["Create KMS key"] --> S1["Set key policy"] --> S2["Encrypt training data"]
Key point: KMS manages keys that you control.
Why the other options are wrong
- B. Amazon S3 managed keys
- S3 manages those keys, not you.
- C. A public S3 endpoint
- An endpoint has nothing to do with encryption keys.
- D. An IAM role policy
- A role controls access, not encryption keys.