Task 1.3: Determine Appropriate Data Security Controls SAA-C03 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A company wants to automatically rotate a customer-managed key in AWS KMS every year to meet security best practices. Which AWS KMS feature should be enabled?

   • AKey policy update
   • BAutomatic key rotation
   • CKey deletion
   • DManual key rotation
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A solutions architect needs to protect data as it travels between an application and an Amazon S3 bucket. Which type of encryption should be used?

   • AEncryption in transit
   • BServer-side encryption
   • CEncryption at rest
   • DClient-side encryption
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company stores customer data in an S3 bucket. A security review requires that only the finance team can access objects with a 'confidential' tag, while other teams can access objects with other tags. The company uses IAM roles for all teams. What should a solutions architect do to meet this requirement?

   • AUse AWS Organizations SCPs to deny s3:GetObject for all principals except the finance team.
   • BCreate a separate S3 bucket for confidential data and replicate objects with that tag to it.
   • CCreate an IAM policy for each team that allows s3:GetObject only when the object tag is not 'confidential'.
   • DCreate an S3 bucket policy that denies s3:GetObject when the object tag is 'confidential' and the principal is not in the finance team's IAM role.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company uses a customer-managed KMS key to encrypt data in Amazon S3. The security policy requires that the key be rotated automatically every year. What should a solutions architect do to meet this requirement?

   • ACreate a new KMS key and use an alias to point to the new key.
   • BEnable automatic key rotation on the KMS key.
   • CManually rotate the KMS key by creating a new key and updating the S3 bucket policy.
   • DUse an AWS-managed KMS key (aws/s3) and enable automatic rotation.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has an S3 bucket in the us-east-1 Region that stores critical data. The company needs to ensure that the data is available in another Region in case of a regional failure. The data must be replicated within 15 minutes. What should a solutions architect configure?

   • AEnable S3 Cross-Region Replication (CRR) to a bucket in us-west-2.
   • BTake a manual snapshot of the bucket and copy it to us-west-2.
   • CUse S3 Versioning and enable MFA Delete.
   • DEnable S3 Same-Region Replication (SRR) to a bucket in us-east-1.
   Reveal Solution Discussion Select an answer first