Task 2: Implement Encryption by Using AWS Services DVA-C02 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A developer manages a KMS customer managed key used to encrypt application secrets. The compliance team requires that the key material be rotated every year. The developer enabled automatic rotation when the key was created. What is the expected behavior of the key after rotation?

   • AThe key ID changes, and all existing ciphertext becomes undecryptable until the data is re-encrypted.
   • BThe developer must manually re-encrypt all data with the new key material after rotation occurs.
   • CKMS automatically creates new key material and retains the old key material so previously encrypted data can still be decrypted.
   • DAutomatic rotation is disabled by default and must be re-enabled after each rotation cycle.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer in Account A needs to decrypt data that was encrypted by a KMS key owned by Account B. The developer's IAM role has been granted kms:Decrypt permission by the Account B administrator. What additional configuration is required for the decryption to succeed?

   • AThe developer must create a new KMS key in Account A and re-encrypt the data with it.
   • BThe KMS key policy in Account B must grant the developer's IAM role permission to use the key.
   • CThe developer must use the AWS Management Console instead of the CLI to perform the decryption.
   • DThe S3 bucket policy must be updated to allow cross-account access to the encrypted objects.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A developer is building an application that must encrypt data before it is uploaded to Amazon S3. The application runs on an EC2 instance and the encryption keys must never be stored on the instance. Which approach should the developer use?

   • AStore the encryption key in a file on the EC2 instance and use it to encrypt the data.
   • BUse an S3 bucket policy to require encryption on all PUT requests.
   • CUse the AWS SDK to call KMS GenerateDataKey, encrypt the data in the application, and upload the ciphertext.
   • DUpload the data to S3 and enable default encryption on the bucket.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A developer manages a KMS customer managed key used to encrypt a database. The key has automatic rotation enabled. The security team is concerned that if the key is compromised, all data encrypted with it will be exposed. What should the developer do to limit the impact of a potential key compromise?

   • ACreate a new KMS key, re-encrypt the database with the new key, and update the application to use the new key.
   • BDisable automatic rotation and manually rotate the key every month.
   • CDelete the compromised key and restore it from a backup.
   • DEnable automatic rotation on the key and rely on it to protect the data.
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   A developer is setting up a local development environment and needs to test HTTPS connections to a local web server. The developer does not want to purchase a public certificate. What is the quickest way to enable HTTPS for local testing?

   • AUse AWS Private CA to issue a certificate for localhost.
   • BGenerate a self-signed certificate using OpenSSL and configure the web server to use it.
   • CDisable HTTPS in the local environment and use HTTP only.
   • DRequest a public certificate from AWS Certificate Manager and export it.
   Reveal Solution Discussion Select an answer first