You are working as an AWS Administrator for a software firm with a popular Web application hosted on EC2 instance in various regions. You are using AWS CloudHSM for offloading SSL/TLS processing from Web servers. Since this is a critical application for the firm, you need to ensure that proper backups are performed for data in AWS CloudHSM daily. What does the AWS CloudHSM use to perform a secure & durable backup?

Answer options:

A.Ephemeral backup key (EBK) is used to encrypt data & Persistent backup key (PBK) is used to encrypt EBK before saving data to the Amazon S3 bucket in the same region as that of AWS CloudHSM cluster.
B.Data Key is used to encrypt data & Customer Managed Key (CMK) is used to encrypt Data Key before saving data to the Amazon S3 bucket in the same region as that of AWS CloudHSM cluster.
C.Ephemeral Backup Key (EBK) is used to encrypt data & Persistent backup Key (PBK) is used to encrypt EBK before saving data to the Amazon S3 bucket in a different region than the AWS CloudHSM cluster.
D.Data Key is used to encrypt data & Customer Managed Key (CMK) is used to encrypt Data Key before saving data to Amazon S3 bucket in a different region than the AWS CloudHSM cluster.

Correct Answer – A
To back up the AWS CloudHSM data to Amazon S3 buckets in the same region, AWS CloudHSM generates a unique Ephemeral Backup Key (EBK) to encrypt all data using AES 256-bit encryption key. This Ephemeral Backup Key (EBK) is further encrypted using Persistent Backup Key (PBK), which is also an AES 256-bit encryption key.
Option B is incorrect as AWS CloudHSM does not use data Key & Customer Managed Key to encrypt data, instead of that EBK & PBK are used.
Option C is incorrect. While taking the backup of data from different AWS CloudHSM clusters to the Amazon S3 bucket, the Amazon S3 bucket should be in the same region as that of the AWS CloudHSM cluster.
Option D is incorrect as AWS CloudHSM does not use data Key & Customer Managed Key to encrypt data. Instead of that, EBK & PBK are used to encrypt and save data to the Amazon S3 bucket in the same region.
For more information on backing data from AWS CloudHSM, refer to the following URL-
https://docs.aws.amazon.com/cloudhsm/latest/userguide/backups.html