A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only specific IAM roles can use the KMS key for encryption and decryption. Which configuration should be implemented?

Attach a key policy to the KMS key that grants kms:Encrypt and kms:Decrypt permissions to the specific IAM roles.

Use AWS Organizations to restrict KMS key usage to specific accounts.

Use an S3 bucket policy to restrict access to the encrypted objects.

Enable automatic key rotation for the KMS key.

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that the KMS key be deleted after a specific project is completed, but they want to ensure that data encrypted with the key can still be decrypted for a period of time. Which solution should be implemented?

Use AWS Secrets Manager to store the KMS key and delete it after the project.

Disable the KMS key immediately and delete it after 7 days.

Schedule the KMS key for deletion with a waiting period, and ensure that the key is not used for new encryption during that period.

Create a new KMS key and re-encrypt all data before deleting the old key.

A company uses AWS Security Hub to aggregate findings from Amazon GuardDuty and AWS Config. The security team wants to receive email notifications when a new high-severity finding is generated. Which solution should a CloudOps engineer implement?

Configure GuardDuty to send email notifications directly to the security team.

Enable Security Hub's built-in email notifications for all findings.

Use AWS Config rules to trigger an SNS topic when a resource is non-compliant.

Create an Amazon CloudWatch Events rule that matches Security Hub findings and triggers an Amazon SNS topic subscribed to the security team's email.

A company is designing a data classification scheme for its AWS environment. The scheme must categorize data into 'Public', 'Internal', 'Confidential', and 'Restricted'. For 'Restricted' data, the company requires that all data be encrypted at rest using customer managed keys. Which AWS service should be used to enforce this requirement?

AWS Identity and Access Management (IAM) policies to deny access to unencrypted resources.

AWS Trusted Advisor to monitor encryption settings for all resources.

Amazon Macie to automatically classify data and apply encryption.

AWS Config rules to check that resources storing 'Restricted' data have encryption enabled.

AWSCertified CloudOps Engineer - Associate

Domain 4Objective 2

Task 4.2: Implement Strategies to Protect Data and Infrastructure. SOA-C03 Practice Questions (Page 3)

Part of the Content Domain 4: Security and Compliance domain, which makes up ~17% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

Questions 11–15

11application · medium
A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only specific IAM roles can use the KMS key for encryption and decryption. Which configuration should be implemented?
Select an answer first
12expert · medium
A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that the KMS key be deleted after a specific project is completed, but they want to ensure that data encrypted with the key can still be decrypted for a period of time. Which solution should be implemented?
Select an answer first
13application · medium
A company uses AWS Security Hub to aggregate findings from Amazon GuardDuty and AWS Config. The security team wants to receive email notifications when a new high-severity finding is generated. Which solution should a CloudOps engineer implement?
Select an answer first
14application · medium
A company is designing a data classification scheme for its AWS environment. The scheme must categorize data into 'Public', 'Internal', 'Confidential', and 'Restricted'. For 'Restricted' data, the company requires that all data be encrypted at rest using customer managed keys. Which AWS service should be used to enforce this requirement?
Select an answer first
15application · medium
A company uses AWS Systems Manager Parameter Store to store configuration data, including some database connection strings that are considered sensitive. The security team requires that these sensitive parameters be encrypted at rest. Which parameter type should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SOA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SOA-C03” is a trademark of its owner, used for identification only.

Task 4.2: Implement Strategies to Protect Data and Infrastructure. SOA-C03 Practice Questions (Page 3)

Questions 11–15

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only specific IAM roles can use the KMS key for encryption and decryption. Which configuration should be implemented?

A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that the KMS key be deleted after a specific project is completed, but they want to ensure that data encrypted with the key can still be decrypted for a period of time. Which solution should be implemented?

A company uses AWS Security Hub to aggregate findings from Amazon GuardDuty and AWS Config. The security team wants to receive email notifications when a new high-severity finding is generated. Which solution should a CloudOps engineer implement?

A company uses AWS Systems Manager Parameter Store to store configuration data, including some database connection strings that are considered sensitive. The security team requires that these sensitive parameters be encrypted at rest. Which parameter type should be used?

Keep studying — Content Domain 4: Security and Compliance