Task 2: Implement Encryption by Using AWS Services DVA-C02 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A company needs to issue certificates for internal applications that are not publicly trusted. Which AWS service can be used to create and manage a private certificate authority (CA) for this purpose?

   • AAWS Identity and Access Management (IAM)
   • BAWS Private Certificate Authority (AWS Private CA)
   • CAWS Certificate Manager (ACM)
   • DAWS Key Management Service (AWS KMS)
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A developer is building a serverless application that stores sensitive documents in Amazon S3. The application must encrypt each document with a unique data key before upload, and the data key must be encrypted with a customer managed KMS key. The developer needs to implement the encryption logic in AWS Lambda. Which combination of AWS SDK calls should the developer use?

   • ACall Decrypt on the document before upload, then re-encrypt it with the S3-managed key using server-side encryption.
   • BCall GenerateRandom to create a 256-bit key, use it to encrypt the document, and rely on S3 server-side encryption to protect the key.
   • CCall Encrypt to encrypt the document directly with the KMS key, then store the resulting ciphertext in S3.
   • DCall GenerateDataKey to get a plaintext data key and a ciphertext blob, encrypt the document with the plaintext key, store the ciphertext blob alongside the document, and discard the plaintext key.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of using AWS Private CA to issue certificates for internal applications?

   • ATo establish trust for internal applications without the cost of public certificates
   • BTo enable encryption of data at rest in Amazon S3
   • CTo provide certificates that are trusted by all web browsers and operating systems
   • DTo manage encryption keys for AWS services
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A developer needs to encrypt a small amount of data (less than 4 KB) programmatically using an AWS KMS key. Which AWS KMS API operation should the developer use?

   • AGenerateDataKey
   • BReEncrypt
   • CSign
   • DEncrypt
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   A developer needs to generate an SSH key pair to connect to an EC2 instance for development. The developer is using a Linux workstation. Which command should the developer use?

   • Aaws ec2 create-key-pair --key-name mykey
   • Bcertbot certonly --standalone
   • Cssh-keygen -t rsa -b 2048
   • Dopenssl req -x509 -newkey rsa:2048 -nodes
   Reveal Solution Discussion Select an answer first