Task 5.2: Design and Implement Controls for Data at Rest SCS-C03 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A security engineer needs to choose between AWS KMS and AWS CloudHSM for encrypting data at rest. The organization requires that AWS personnel cannot access the encryption keys, and the keys must be managed within a hardware security module (HSM) that the organization controls. Which service should the engineer choose?

   • AAWS Certificate Manager (ACM)
   • BAWS KMS with a customer managed key
   • CAWS KMS with an AWS managed key
   • DAWS CloudHSM
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An application writes sensitive data to Amazon S3. The security policy requires that the data be encrypted at rest, but the application must manage its own encryption keys and cannot use AWS KMS. Which server-side encryption option should be used?

   • ASSE-S3
   • BClient-side encryption
   • CSSE-C
   • DSSE-KMS
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security engineer is configuring S3 Glacier Vault Lock. What is the purpose of the two-step process that includes initiating the lock and then completing the lock?

   • ATo allow the policy to be tested for 24 hours before it becomes immutable
   • BTo require approval from two administrators before the lock is applied
   • CTo ensure that the vault is empty before the lock is applied
   • DTo provide a grace period during which the policy can be changed before it becomes immutable
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A company uses Amazon FSx for Lustre for high-performance computing. They need to ensure that the file system is backed up automatically on a schedule for data retention and recovery. Which feature should be used?

   • AFSx for Lustre automatic backups
   • BFSx for Lustre data replication
   • CFSx for Lustre lifecycle policies
   • DFSx for Lustre data compression
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A company wants to protect its data at rest from ransomware attacks. Which strategy is most effective for ensuring that backups cannot be encrypted or deleted by an attacker?

   • ADisable versioning on backup buckets to reduce complexity
   • BUse immutable backups with S3 Object Lock in compliance mode
   • CGrant all users full access to backup data for ease of recovery
   • DStore backups in the same S3 bucket as the production data
   Reveal Solution Discussion Select an answer first