A company uses AWS Certificate Manager (ACM) to manage SSL/TLS certificates for its Application Load Balancer (ALB). The security team wants to be notified if a certificate is nearing expiration. Which solution should be implemented?

Create an Amazon CloudWatch Events rule that matches ACM certificate expiration events and sends a notification to an SNS topic.

Use Amazon Inspector to check for certificate expiration.

Enable ACM's built-in email notifications for certificate expiration.

Use AWS Config to monitor certificate expiration and trigger an SNS notification.

A company stores API keys for third-party services in AWS Secrets Manager. The security team requires that the keys be encrypted at rest and that access be logged for auditing. Which configuration should a CloudOps engineer implement?

Use AWS Config to record Secrets Manager resource changes and enable default encryption.

Enable AWS CloudTrail to log Secrets Manager API calls and use AWS KMS customer managed keys for encryption.

Enable Amazon S3 server access logging for the Secrets Manager bucket.

Enable VPC Flow Logs to capture access to Secrets Manager.

AWSCertified CloudOps Engineer - Associate

Domain 4Objective 2

Task 4.2: Implement Strategies to Protect Data and Infrastructure. SOA-C03 Practice Questions (Page 5)

Part of the Content Domain 4: Security and Compliance domain, which makes up ~17% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

Questions 21–23

21application · medium
A company uses AWS Certificate Manager (ACM) to manage SSL/TLS certificates for its Application Load Balancer (ALB). The security team wants to be notified if a certificate is nearing expiration. Which solution should be implemented?
Select an answer first
22application · medium
A company stores API keys for third-party services in AWS Secrets Manager. The security team requires that the keys be encrypted at rest and that access be logged for auditing. Which configuration should a CloudOps engineer implement?
Select an answer first
23foundation · easy
A company must enforce a data classification scheme where all data classified as 'Confidential' must be encrypted and only accessible to the Finance team. Which AWS service is BEST suited to automatically enforce this policy?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SOA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SOA-C03” is a trademark of its owner, used for identification only.

Task 4.2: Implement Strategies to Protect Data and Infrastructure. SOA-C03 Practice Questions (Page 5)

Questions 21–23

A company uses AWS Certificate Manager (ACM) to manage SSL/TLS certificates for its Application Load Balancer (ALB). The security team wants to be notified if a certificate is nearing expiration. Which solution should be implemented?

A company stores API keys for third-party services in AWS Secrets Manager. The security team requires that the keys be encrypted at rest and that access be logged for auditing. Which configuration should a CloudOps engineer implement?

A company must enforce a data classification scheme where all data classified as 'Confidential' must be encrypted and only accessible to the Finance team. Which AWS service is BEST suited to automatically enforce this policy?

Keep studying — Content Domain 4: Security and Compliance