Task 5.2: Design and Implement Controls for Data at Rest SCS-C03 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services company must encrypt sensitive customer data stored in Amazon S3. The compliance team requires that the encryption keys be stored in hardware that the company fully controls, with no AWS access to the key material, and that the company manage the key lifecycle independently of AWS. Which solution meets these requirements?

   • AUse AWS KMS with a customer managed key (CMK) and enable automatic key rotation.
   • BUse SSE-C with customer-provided keys passed in each S3 API call.
   • CUse SSE-S3 with Amazon S3-managed keys for all objects.
   • DUse AWS CloudHSM with a customer-managed cluster and generate the keys within the HSM.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A company needs to automatically delete old log files from an S3 bucket after 90 days to comply with data retention policies. Which action should be configured in an S3 lifecycle policy?

   • AExpiration
   • BEnable versioning
   • CTransition to S3 Glacier Instant Retrieval
   • DAbort incomplete multipart uploads
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A company archives data in Amazon S3 Glacier and needs to enforce a policy that prevents any user, including the root user, from modifying or deleting the archived data for a fixed period. Which feature should be used?

   • AS3 Glacier Vault Lock
   • BS3 bucket policies
   • CS3 lifecycle policies
   • DS3 Object Lock in governance mode
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A company wants to automate the creation, retention, and deletion of snapshots for Amazon EBS volumes. Which AWS service should be used?

   • AAmazon Data Lifecycle Manager (DLM)
   • BAWS Backup
   • CAmazon S3 Lifecycle policies
   • DAWS CloudFormation
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is concerned about ransomware attacks that could encrypt or delete their critical data stored in Amazon S3. They want to implement a defense-in-depth strategy that includes immutable backups and least privilege access. Which combination of controls should they implement?

   • AEnable S3 Versioning, S3 Object Lock in compliance mode, and use IAM policies with least privilege.
   • BEnable S3 Object Lock in governance mode and use a strong bucket policy.
   • CUse AWS Backup to create backups and store them in a separate account.
   • DEnable S3 Versioning and use a bucket policy that denies all delete operations.
   Reveal Solution Discussion Select an answer first