Data Protection, Encryption, and Key Management
This domain tests how data is classified, protected in transit and at rest, and how keys are governed across cloud services.
Core rules
- Classify data first; controls follow sensitivity, residency, and retention requirements.
- Encrypt in transit with TLS 1.2 or later and at rest with provider-managed or customer-managed keys. Customer-managed keys give control over rotation, disablement, and audit.
- Envelope encryption: data keys encrypt data, and a KMS key encrypts data keys. Key policies and IAM both govern access.
- Separate key administration from data access; enable rotation; plan for crypto-shredding through key deletion and its backup impact.
- Secrets belong in a vault, not in images, code, or environment variables where possible.
Worked example
A team stores backups in object storage. They use SSE-KMS with a customer-managed key, restrict kms:Decrypt to a backup role, enable automatic rotation, and log key use. When a bucket policy is misconfigured, the data remains unreadable without Decrypt. Reasoning: encryption is a compensating control only if key access is narrower than data access and audited.
Traps
- Believing encryption at rest replaces access control.
- Deleting a KMS key without checking backups and replicas.
- Storing secrets in Git or container images.
- Ignoring metadata, logs, and snapshots as data copies.