Task 5.3: Design and Implement Controls to Protect Confidential Data, Credentials, Secrets, and Cryptographic Key Materials SCS-C03 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the purpose of Amazon SNS message data protection?

   • ATo control which subscribers can receive messages
   • BTo archive messages to S3
   • CTo redact sensitive data in messages published to SNS topics
   • DTo encrypt messages in transit
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the purpose of a key policy in AWS KMS?

   • ATo define the encryption algorithm used by the key
   • BTo specify the AWS Region where the key is stored
   • CTo set the rotation schedule for the key
   • DTo control who can use and manage a KMS key
   Reveal Solution Discussion Select an answer first
4. 33expert · medium

   A company operates in two AWS Regions and needs to encrypt data in both Regions using the same KMS key. They want to be able to encrypt in one Region and decrypt in the other. The key must be managed centrally. What is the most appropriate solution?

   • ACreate a multi-Region KMS key in the primary Region and create a replica in the secondary Region.
   • BUse a single KMS key in one Region and access it from the other Region over the network.
   • CCreate two separate customer managed keys, one in each Region, and share the key material between them.
   • DUse an AWS managed key in each Region, as they are automatically replicated.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the benefit of enabling automatic rotation for a secret in AWS Secrets Manager?

   • AIt automatically deletes old versions of the secret
   • BIt ensures the secret is encrypted with a new KMS key each time
   • CIt reduces the risk of compromised credentials being used for a long period
   • DIt eliminates the need for IAM policies on the secret
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is an AWS KMS external key store (XKS)?

   • AA feature that exports your AWS KMS keys to your on-premises environment
   • BA feature that allows you to use encryption keys from an external key management system that you control
   • CA service that stores your keys in a different AWS Region
   • DA service that automatically rotates keys using AWS-managed HSMs
   Reveal Solution Discussion Select an answer first