Knowledge check

Envelope encryption: how a KMS actually protects your data

10 questions testing what you just read — no login, no tracking, just immediate feedback.

Question 1 of 10

What problem does envelope encryption solve that direct master-key encryption doesn't?

Question 2 of 10

What is a DEK?

Question 3 of 10

What does "wrapping" a DEK mean?

Question 4 of 10

What does a KMS's Decrypt call actually see?

Question 5 of 10

Why does an attacker with stolen ciphertext and its wrapped DEK still have nothing?

Question 6 of 10

What determines the size of an RSA-OAEP wrapped DEK's ciphertext?

Question 7 of 10

Why do production systems often avoid generating a brand-new DEK via a live KMS call for every single small object?

Question 8 of 10

What is the single biggest operational payoff of envelope encryption over direct master-key encryption?

Question 9 of 10

When a KEK is rotated, what happens to already-wrapped DEKs from before the rotation?

Question 10 of 10

Which cipher does the DEK typically use to encrypt data locally?

0 / 10 answered