Task 5.3: Design and Implement Controls to Protect Confidential Data, Credentials, Secrets, and Cryptographic Key Materials SCS-C03 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security engineer needs a centralized service to store database credentials, API keys, and other secrets, with the ability to control access using IAM policies. Which AWS service is designed for this purpose?

   • AAWS Certificate Manager (ACM)
   • BAWS Key Management Service (KMS)
   • CAWS Systems Manager Parameter Store
   • DAWS Secrets Manager
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A security team wants to use a key generated on an on-premises hardware security module (HSM) to encrypt data in AWS. Which AWS KMS feature allows them to use this key material?

   • AEnabling automatic key rotation
   • BImporting key material into a customer managed key
   • CCreating a multi-Region key
   • DUsing an AWS managed key
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is using Amazon CloudWatch Logs to store application logs. The logs contain credit card numbers that must be masked before they are stored. The company wants to automatically redact this sensitive data as it is ingested. What should they do?

   • AUse an Amazon SNS message data protection policy to redact the credit card numbers before they are sent to CloudWatch Logs.
   • BUse AWS WAF to inspect and redact the logs before they reach CloudWatch Logs.
   • CCreate a CloudWatch Logs data protection policy that identifies credit card numbers and masks them.
   • DConfigure the application to use a Lambda function to redact the logs before sending them to CloudWatch Logs.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a common use case for AWS Private Certificate Authority?

   • AManaging DNS records for a domain
   • BEncrypting data in transit for all internet traffic
   • CIssuing certificates for public websites
   • DIssuing certificates for internal applications and devices
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is required for an IAM principal to retrieve a secret from AWS Secrets Manager?

   • AAn IAM policy that grants the secretsmanager:GetSecretValue permission on the secret
   • BThe secret must be stored in the same AWS Region as the IAM principal
   • CThe secret must be encrypted with a customer managed KMS key
   • DThe IAM principal must have the AmazonS3ReadOnlyAccess managed policy
   Reveal Solution Discussion Select an answer first