A company wants to automatically rotate the password for a database user every 30 days. Which AWS Secrets Manager feature should be used?

Manual rotation using the AWS CLI

Automatic rotation with a schedule

IAM policy to force password change

AWS Config rule to detect password age

A company has an AWS KMS customer managed key with imported key material. The security team suspects that the key material has been compromised and wants to invalidate the current key material and replace it with new material. The key is currently in use to encrypt data in Amazon S3. What is the correct procedure to replace the key material?

Disable the key, wait for the old key material to expire, and then enable the key again.

Delete the KMS key and create a new KMS key, then re-encrypt all data with the new key.

Use the UpdateKeyDescription API to change the key material.

Use the ReImportKeyMaterial API to upload new key material to the existing KMS key.

What is the primary purpose of AWS Secrets Manager?

To provide a managed firewall for web applications

To encrypt data at rest in Amazon S3

To monitor API calls and audit activity in an AWS account

To store and manage secrets such as database credentials and API keys

What is a key difference between rotating an AWS-generated KMS key and an imported KMS key?

Imported keys support automatic rotation, while AWS-generated keys require manual rotation

Both support automatic rotation with the same configuration

AWS-generated keys support automatic rotation, while imported keys require manual rotation by importing new key material

What is an alias in AWS KMS?

A permission that allows another account to use the key

AWSCertified Security - Specialty

Domain 5Objective 3

Task 5.3: Design and Implement Controls to Protect Confidential Data, Credentials, Secrets, and Cryptographic Key Materials SCS-C03 Practice Questions (Page 1)

Part of the Content Domain 5: Data Protection domain, which accounts for 18% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~13–21 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

14concepts

18%of the exam

14 Concepts in This Objective

AWS Secrets Manager basics
Secret rotation strategies
Secret retrieval and access control
Importing key material into KMS
Managing imported key material
Rotating imported key material
External key stores (XKS)
Comparing imported vs AWS-generated key material
CloudWatch Logs data protection
SNS message data protection
Creating and managing KMS keys
Multi-Region KMS keys
AWS Private Certificate Authority (PCA)
Certificate lifecycle management

Questions 1–5

1foundation · easy
A company wants to automatically rotate the password for a database user every 30 days. Which AWS Secrets Manager feature should be used?
Select an answer first
2application · medium
A company has an AWS KMS customer managed key with imported key material. The security team suspects that the key material has been compromised and wants to invalidate the current key material and replace it with new material. The key is currently in use to encrypt data in Amazon S3. What is the correct procedure to replace the key material?
Select an answer first
3foundation · easy
What is the primary purpose of AWS Secrets Manager?
Select an answer first
4foundation · easy
What is a key difference between rotating an AWS-generated KMS key and an imported KMS key?
Select an answer first
5foundation · easy
What is an alias in AWS KMS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.