Task 5.2: Design and Implement Controls for Data at Rest SCS-C03 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A software vendor distributes installation binaries to customers via Amazon S3. Customers need to verify that the binaries were not tampered with and that they were indeed created by the vendor. Which approach should the vendor use to provide this assurance?

   • AUse S3 Object Lock with a legal hold on the binaries.
   • BEncrypt the binaries with SSE-KMS before uploading them to S3.
   • CSign the binaries with the vendor's private key and provide the public key to customers.
   • DStore the binaries in an S3 bucket with a bucket policy that allows only authenticated users to download.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A company is using S3 Object Lock to protect objects from deletion. A user needs to temporarily prevent deletion of a specific object without setting a retention period, and the protection must be removable by authorized users. Which S3 Object Lock feature should be used?

   • ALegal hold
   • BCompliance mode retention
   • CGovernance mode retention
   • DBucket versioning
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A company wants to centralize and automate backup policies across multiple AWS services, including Amazon RDS, EBS volumes, and Amazon S3. Which AWS service should be used?

   • AAmazon S3 Lifecycle policies
   • BAmazon Data Lifecycle Manager (DLM)
   • CAWS Backup
   • DAWS Storage Gateway
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company has a strict security policy that requires data to be encrypted before it leaves the corporate network. They are building a new application that will upload sensitive files to Amazon S3. The application team wants to use AWS KMS for key management, but the security team insists that the data must be encrypted on-premises before transmission. Which approach should the company implement?

   • AUse an AWS Site-to-Site VPN to encrypt the connection to S3.
   • BUse S3 server-side encryption with SSE-KMS on the destination bucket.
   • CUse client-side encryption with the AWS Encryption SDK and a KMS key.
   • DUse S3 server-side encryption with SSE-C and provide the key in the upload request.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has on-premises file servers with sensitive data that must be replicated to Amazon S3 for disaster recovery. The data must be encrypted in transit and at rest in S3. The company wants to automate the replication process. Which service should they use?

   • AUse AWS Database Migration Service (DMS) to replicate the data to S3.
   • BUse AWS DataSync to replicate the data to S3 with encryption in transit and SSE-KMS for at-rest encryption.
   • CUse AWS Storage Gateway File Gateway to replicate the data to S3.
   • DUse an S3 lifecycle policy to replicate the data to S3.
   Reveal Solution Discussion Select an answer first