AWSCertified Security - Specialty
Domain 5Objective 3
Task 5.3: Design and Implement Controls to Protect Confidential Data, Credentials, Secrets, and Cryptographic Key Materials SCS-C03 Practice Questions (Page 6)
Part of the Content Domain 5: Data Protection domain, which accounts for 18% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~13–21 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)
35questions here
7free pages
14concepts
18%of the exam
Questions 26–30
- 26
A company uses AWS Private Certificate Authority (PCA) to issue certificates for internal services. A certificate for a critical service has been compromised and must be revoked immediately. What is the most efficient way to revoke the certificate?
Select an answer first - 27
A multinational company is subject to a data sovereignty regulation that requires cryptographic keys used to protect data in a specific country to be stored and used only within that country. They are using AWS KMS and have an on-premises HSM in that country. They want to use AWS KMS for encryption operations but keep the keys in their HSM. What is the most appropriate solution?
Select an answer first - 28
Which AWS service can apply data protection policies to mask sensitive data in log events?
Select an answer first - 29
What is the purpose of a multi-Region KMS key?
Select an answer first - 30
What is the purpose of a data protection policy in CloudWatch Logs?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.