What is a key characteristic of a multi-Region KMS key?

It requires a separate key policy in each Region

It has the same key ID and key material in all Regions where it is replicated

It uses different key material in each Region

It can only be used in the Region where it was created

What happens to an AWS KMS key with imported key material if the key material is deleted?

The KMS key becomes unusable until new key material is imported

The KMS key is automatically deleted after 7 days

The KMS key is immediately deleted

The KMS key continues to work using a backup copy of the key material

What is a primary benefit of using an external key store (XKS) with AWS KMS?

It allows you to maintain control of the key material in your own key management system

It reduces the cost of KMS key usage

It automatically replicates keys to all AWS Regions

It eliminates the need for IAM policies to control access to keys

A security engineer needs to delete the key material from an imported KMS key. What is the correct way to do this?

Delete the key material using the AWS KMS console or API

Which type of KMS key material gives you more direct control over the key material itself?

Neither provides control over key material

Both provide the same level of control

AWSCertified Security - Specialty

Domain 5Objective 3

Task 5.3: Design and Implement Controls to Protect Confidential Data, Credentials, Secrets, and Cryptographic Key Materials SCS-C03 Practice Questions (Page 5)

Part of the Content Domain 5: Data Protection domain, which accounts for 18% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~13–21 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

14concepts

18%of the exam

14 Concepts in This Objective

AWS Secrets Manager basics
Secret rotation strategies
Secret retrieval and access control
Importing key material into KMS
Managing imported key material
Rotating imported key material
External key stores (XKS)
Comparing imported vs AWS-generated key material
CloudWatch Logs data protection
SNS message data protection
Creating and managing KMS keys
Multi-Region KMS keys
AWS Private Certificate Authority (PCA)
Certificate lifecycle management

Questions 21–25

21foundation · easy
What is a key characteristic of a multi-Region KMS key?
Select an answer first
22foundation · easy
What happens to an AWS KMS key with imported key material if the key material is deleted?
Select an answer first
23foundation · easy
What is a primary benefit of using an external key store (XKS) with AWS KMS?
Select an answer first
24foundation · easy
A security engineer needs to delete the key material from an imported KMS key. What is the correct way to do this?
Select an answer first
25foundation · easy
Which type of KMS key material gives you more direct control over the key material itself?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.