You are using AWS Envelope Encryption to encrypt all of your sensitive data. Which of the following is true with regards to the AWS Envelope Encryption service?

Answer options:

A.First, the data is encrypted using an encrypted Data Key. The encrypted Data Key is then further encrypted using an encrypted Master Key.
B.First, the data is encrypted using a plaintext Data Key. The Data Key is then further encrypted using an encrypted Master Key.
C.First, the data is encrypted using an encrypted Data Key. The encrypted Data Key is then further encrypted using a plaintext Master Key.
D.First, the data is encrypted using a plaintext Data Key. The Data Key is then further encrypted using a plaintext Master Key.

Correct Answer – D
With Envelope Encryption, unencrypted data is encrypted using a plaintext Data key. This Data key is further encrypted using a plaintext Master key. This plaintext Master key is securely stored in AWS KMS& known as Customer Master Keys.
Option A is incorrect as the Data Key used for encryption of data is plaintext along with the Master key used to encrypt Data Keys.
Option B is incorrect as the Master key used to encrypt Data Keys is in plaintext format.
Option C is incorrect as the Data Key used for encryption of data is in plaintext format.
For more information on AWS KMS Envelope Encryption, refer to the following URL-
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html