What is the first step to import key material into an AWS KMS customer managed key?

Download the import token and public key from AWS KMS

Create a customer managed key with the origin set to EXTERNAL

Encrypt the key material with the AWS KMS public key

Upload the encrypted key material to AWS KMS

A developer is writing a serverless application on AWS Lambda that needs to retrieve a database password from AWS Secrets Manager at runtime. The application is deployed in the us-east-1 Region. The security team mandates that the password must never be stored in the Lambda environment variables or in the application code. What is the most secure and efficient way to retrieve the secret?

Use AWS AppConfig to store the secret and retrieve it using the AppConfig agent.

Use the AWS SDK to call GetSecretValue from within the Lambda function, caching the secret in memory for subsequent invocations.

Store the secret in an environment variable that is encrypted with a KMS key and reference it in the code.

Use the AWS CLI to run the get-secret-value command in a shell script within the Lambda function.

What is a common way to check if a certificate has been revoked in AWS Private CA?

Using the AWS Management Console to view certificate status

Using the certificate's serial number

Using a certificate revocation list (CRL)

Using the AWS CLI to query the certificate

What is the purpose of AWS Private Certificate Authority (PCA)?

To create and manage private certificates for internal use

To manage DNS records for your domain

To issue publicly trusted SSL/TLS certificates

What is the purpose of certificate revocation in AWS Private CA?

To renew a certificate automatically

To export the certificate to a different format

To invalidate a certificate before its expiration date

To create a new certificate with the same key

AWSCertified Security - Specialty

Domain 5Objective 3

Task 5.3: Design and Implement Controls to Protect Confidential Data, Credentials, Secrets, and Cryptographic Key Materials SCS-C03 Practice Questions (Page 3)

Part of the Content Domain 5: Data Protection domain, which accounts for 18% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~13–21 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

14concepts

18%of the exam

14 Concepts in This Objective

AWS Secrets Manager basics
Secret rotation strategies
Secret retrieval and access control
Importing key material into KMS
Managing imported key material
Rotating imported key material
External key stores (XKS)
Comparing imported vs AWS-generated key material
CloudWatch Logs data protection
SNS message data protection
Creating and managing KMS keys
Multi-Region KMS keys
AWS Private Certificate Authority (PCA)
Certificate lifecycle management

Questions 11–15

11foundation · easy
What is the first step to import key material into an AWS KMS customer managed key?
Select an answer first
12application · medium
A developer is writing a serverless application on AWS Lambda that needs to retrieve a database password from AWS Secrets Manager at runtime. The application is deployed in the us-east-1 Region. The security team mandates that the password must never be stored in the Lambda environment variables or in the application code. What is the most secure and efficient way to retrieve the secret?
Select an answer first
13foundation · easy
What is a common way to check if a certificate has been revoked in AWS Private CA?
Select an answer first
14foundation · easy
What is the purpose of AWS Private Certificate Authority (PCA)?
Select an answer first
15foundation · easy
What is the purpose of certificate revocation in AWS Private CA?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.