Task 4.2: Implement Strategies to Protect Data and Infrastructure. SOA-C03 Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A company is implementing a data classification scheme. Data classified as 'Restricted' must be encrypted at rest and access must be logged. The company uses Amazon S3 for storage. Which combination of AWS services should be used to enforce this requirement?

   • AUse IAM policies to deny access to unencrypted buckets and enable AWS Config.
   • BUse AWS Trusted Advisor to check encryption and enable VPC Flow Logs.
   • CUse AWS Config rules to check that S3 buckets are encrypted and enable AWS CloudTrail to log S3 API calls.
   • DUse Amazon Macie to automatically encrypt S3 objects and enable S3 server access logging.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company runs a web application on an Application Load Balancer (ALB) and uses AWS Certificate Manager (ACM) to manage its SSL/TLS certificate. The certificate is about to expire, and the security team wants to ensure that the certificate is automatically renewed without manual intervention. Which action should be taken?

   • AUse AWS Certificate Manager Private Certificate Authority (ACM PCA) to issue a new certificate.
   • BEnsure that the certificate was issued by ACM and that DNS validation was used; ACM automatically renews certificates.
   • CExport the certificate and re-import it into ACM before expiration.
   • DManually request a new certificate and attach it to the ALB before expiration.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A CloudOps engineer needs to encrypt data at rest in an Amazon S3 bucket using a customer-managed key. Which AWS KMS key type should the engineer create?

   • AAsymmetric customer managed key (CMK)
   • BAWS owned key
   • CSymmetric customer managed key (CMK)
   • DAWS managed key (aws/s3)
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A CloudOps engineer needs to store a database password that must be automatically rotated every 30 days. Which AWS service is BEST suited for this requirement?

   • AAmazon S3 with server-side encryption
   • BAWS Key Management Service (KMS)
   • CAWS Secrets Manager
   • DAWS Systems Manager Parameter Store
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company uses Amazon GuardDuty and AWS Security Hub. The security team wants to automatically remediate a specific finding type, such as an S3 bucket with public read access. Which solution should be implemented?

   • AUse AWS Config managed rule to automatically remediate the S3 bucket policy.
   • BEnable GuardDuty's automatic remediation feature.
   • CCreate an AWS Lambda function that runs periodically to check and fix S3 bucket policies.
   • DCreate an AWS Systems Manager Automation document and a CloudWatch Events rule to trigger it when the finding is generated.
   Reveal Solution Discussion Select an answer first