Task 5.3: Design and Implement Controls to Protect Confidential Data, Credentials, Secrets, and Cryptographic Key Materials SCS-C03 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a common use case for Amazon SNS message data protection?

   • AFiltering messages based on message attributes
   • BEncrypting messages with a KMS key
   • CDelivering messages to multiple protocols
   • DRedacting credit card numbers from messages before they are delivered to subscribers
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How can you rotate an AWS KMS key that uses imported key material?

   • ACreate new key material and import it into the same KMS key
   • BCreate a new KMS key and update all applications to use it
   • CEnable automatic rotation in the KMS key settings
   • DUse the AWS Management Console to generate new key material
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company uses Amazon SNS to publish order notifications. The messages contain customer email addresses and phone numbers, which must be redacted before they are delivered to subscribers. The company wants to implement this without modifying the application code. What should they do?

   • ACreate an SNS message data protection policy that identifies email addresses and phone numbers and redacts them.
   • BUse an SQS queue with a redaction policy to filter the messages before they are sent to SNS.
   • CConfigure the SNS topic to use a Lambda function as a subscriber to redact the messages.
   • DUse a CloudWatch Logs data protection policy to redact the data before it is published to SNS.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security engineer needs to rotate the imported key material for a customer managed KMS key. The key is used to encrypt data in Amazon S3. The rotation must not change the key ID, and the old key material must be available for decryption of data encrypted with it. What is the correct way to achieve this?

   • AEnable automatic rotation on the KMS key, which will automatically rotate imported key material.
   • BUse the RotateKeyOnDemand API to rotate the key material.
   • CImport new key material into the existing KMS key using the ImportKeyMaterial API, and retain the old key material for decryption.
   • DCreate a new KMS key with new imported key material and update the S3 bucket policy to use the new key.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An application running on an EC2 instance needs to retrieve a database secret from AWS Secrets Manager. Which AWS SDK call should the application use?

   • APutSecretValue
   • BGetSecretValue
   • CDescribeSecret
   • DListSecrets
   Reveal Solution Discussion Select an answer first