Task 4.2: Implement Strategies to Protect Data and Infrastructure. SOA-C03 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company runs a web application on an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The security team requires that all traffic between clients and the ALB be encrypted in transit. The company has a public domain name and wants to use AWS Certificate Manager (ACM) to provision a certificate. Which step is required to successfully issue and use the certificate?

   • AUpload a certificate from a third-party CA to ACM and attach it to the ALB without validation.
   • BGenerate a self-signed certificate in ACM and attach it to the ALB without domain validation.
   • CCreate a certificate in ACM, validate domain ownership via DNS, and attach the certificate to the ALB's HTTPS listener.
   • DExport the certificate from ACM and install it on each EC2 instance.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company uses AWS Secrets Manager to store database credentials for a production application. The security team requires that the credentials be rotated automatically every 30 days. The database is an Amazon RDS for MySQL instance. Which solution meets the requirement with the least operational effort?

   • ACreate a custom AWS Lambda function that updates the secret and the database password, and schedule it with Amazon CloudWatch Events.
   • BStore the credentials in AWS Systems Manager Parameter Store and enable automatic rotation.
   • CUse AWS Secrets Manager's built-in rotation for RDS MySQL, configuring the rotation interval to 30 days.
   • DManually rotate the credentials every 30 days using the AWS Management Console.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A CloudOps engineer notices that an ACM certificate used by an Application Load Balancer is about to expire. What should the engineer do to ensure the certificate is renewed automatically?

   • AManually renew the certificate 30 days before expiration
   • BCreate a new certificate and attach it to the ALB before the old one expires
   • CEnsure the certificate was issued by ACM and that DNS validation is configured with the correct CNAME record
   • DExport the certificate and re-import it before expiration
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A company uses AWS KMS to encrypt data in Amazon S3. The security team requires that the KMS key be rotated automatically every year. The company also needs to ensure that the key can be used to decrypt data that was encrypted with the previous key material. Which configuration should be implemented?

   • AEnable automatic key rotation for the KMS key.
   • BManually rotate the KMS key by creating a new key and re-encrypting all data.
   • CUse AWS Secrets Manager to rotate the KMS key.
   • DCreate a new KMS key every year and update the S3 bucket policy to use the new key.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Amazon GuardDuty has generated a finding indicating a potential compromise of an EC2 instance. What is the FIRST step a CloudOps engineer should take to remediate the finding?

   • ADelete the instance immediately
   • BIsolate the instance by applying a security group that blocks all traffic
   • CIgnore the finding and monitor for additional activity
   • DDisable GuardDuty to stop generating findings
   Reveal Solution Discussion Select an answer first