A CloudOps engineer is designing a data classification scheme for a company that stores customer PII, internal financial reports, and public marketing materials in Amazon S3. Which combination of actions BEST represents a data classification scheme?

Creating separate S3 buckets for each department and granting full access to the respective department

Configuring S3 Lifecycle policies to transition older objects to S3 Glacier storage

Enabling S3 server-side encryption on all buckets to protect data at rest

Tagging each S3 object with a classification label and applying bucket policies that restrict access based on those labels

A company uses AWS Security Hub to aggregate findings from multiple accounts. The security team wants to generate a monthly report of all high-severity findings for compliance purposes. Which solution should be implemented?

Manually export findings from the Security Hub console each month.

Use Amazon Inspector to generate a monthly compliance report.

Use Security Hub's integration with Amazon QuickSight to create a dashboard and schedule a report.

Use AWS Config to generate a monthly report of findings.

An application is failing to decrypt an S3 object encrypted with a customer managed key. The CloudOps engineer checks the KMS key policy and the IAM permissions of the application's role. Which of the following is the MOST likely cause of the decryption failure?

The S3 bucket policy does not allow s3:GetObject

The S3 object is encrypted with SSE-S3, not SSE-KMS

The IAM role lacks the kms:Decrypt permission for the key

A company uses AWS Secrets Manager to store database credentials. The security team requires that the credentials be rotated automatically, but the database is a custom application that does not support native rotation. Which solution should be implemented?

Manually rotate the credentials every 30 days.

Create a custom AWS Lambda function to rotate the secret and update the database password, and configure Secrets Manager to use it.

Use AWS KMS to rotate the database password.

Use AWS Systems Manager Parameter Store with automatic rotation.

AWSCertified CloudOps Engineer - Associate

Domain 4Objective 2

Task 4.2: Implement Strategies to Protect Data and Infrastructure. SOA-C03 Practice Questions (Page 2)

Part of the Content Domain 4: Security and Compliance domain, which makes up ~17% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

Questions 6–10

6foundation · easy
A CloudOps engineer is designing a data classification scheme for a company that stores customer PII, internal financial reports, and public marketing materials in Amazon S3. Which combination of actions BEST represents a data classification scheme?
Select an answer first
7application · medium
A company uses AWS Security Hub to aggregate findings from multiple accounts. The security team wants to generate a monthly report of all high-severity findings for compliance purposes. Which solution should be implemented?
Select an answer first
8foundation · easy
A CloudOps engineer wants a single dashboard to aggregate security findings from Amazon GuardDuty, Amazon Inspector, and AWS Config. Which AWS service provides this consolidated view?
Select an answer first
9foundation · easy
An application is failing to decrypt an S3 object encrypted with a customer managed key. The CloudOps engineer checks the KMS key policy and the IAM permissions of the application's role. Which of the following is the MOST likely cause of the decryption failure?
Select an answer first
10expert · medium
A company uses AWS Secrets Manager to store database credentials. The security team requires that the credentials be rotated automatically, but the database is a custom application that does not support native rotation. Which solution should be implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SOA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SOA-C03” is a trademark of its owner, used for identification only.