A company runs an Amazon EMR cluster with multiple core and task nodes. A compliance requirement mandates that all data transferred between nodes in the cluster be encrypted. What should the security engineer configure when launching the cluster?

Use a custom AMI that has TLS configured for all Hadoop daemons.

Enable encryption at rest using an EMR security configuration with an AWS KMS key.

Enable the security configuration with inter-node encryption and specify the encryption options for the Hadoop services.

Place all nodes in the same placement group to reduce the need for encryption.

A company runs a microservices application on Amazon EKS. The security team requires that all pod-to-pod communication be encrypted. The application is built with a mix of services that support TLS and some that do not. The company wants to minimize changes to the application code. What should the security engineer implement?

Configure each service to use TLS by updating the application code.

Enable the EKS cluster's built-in encryption for pod-to-pod traffic.

Use AWS App Mesh with mutual TLS (mTLS) enabled for all services.

Use a network policy to restrict pod-to-pod communication to specific ports.

AWSCertified Security - Specialty

Domain 5Objective 1

Task 5.1: Design and Implement Controls for Data in Transit SCS-C03 Practice Questions (Page 1)

Part of the Content Domain 5: Data Protection domain, which accounts for 18% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~13–21 in this domain), expect 4–7 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

10concepts

18%of the exam

Questions 1–5

1foundation · easy
A company needs to access an AWS service privately from its VPC without using the public internet. Which AWS feature provides this connectivity?
Select an answer first
2foundation · easy
Which type of VPC endpoint is used to access Amazon S3 privately without requiring a public IP address?
Select an answer first
3application · medium
A company runs an Amazon EMR cluster with multiple core and task nodes. A compliance requirement mandates that all data transferred between nodes in the cluster be encrypted. What should the security engineer configure when launching the cluster?
Select an answer first
4foundation · easy
Which AWS service provides secure remote access to a VPC for individual users using an OpenVPN-based client?
Select an answer first
5expert · hard
A company runs a microservices application on Amazon EKS. The security team requires that all pod-to-pod communication be encrypted. The application is built with a mix of services that support TLS and some that do not. The company wants to minimize changes to the application code. What should the security engineer implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 5.1: Design and Implement Controls for Data in Transit SCS-C03 Practice Questions (Page 1)

Questions 1–5

A company needs to access an AWS service privately from its VPC without using the public internet. Which AWS feature provides this connectivity?

Which type of VPC endpoint is used to access Amazon S3 privately without requiring a public IP address?

A company runs an Amazon EMR cluster with multiple core and task nodes. A compliance requirement mandates that all data transferred between nodes in the cluster be encrypted. What should the security engineer configure when launching the cluster?

Which AWS service provides secure remote access to a VPC for individual users using an OpenVPN-based client?

Keep studying — Content Domain 5: Data Protection