AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 32
Question 310
A compliance team needs evidence that confidential S3 objects are encrypted with the intended customer-managed KMS key. A developer proposes copying KMS plaintext key material into the application to inspect object bytes locally. What is the better validation strategy?
- Export the customer-managed KMS key's plaintext symmetric key from AWS KMS into the application repository.
- Disable S3 bucket policy validation because an object is automatically confidential whenever it is versioned.
- Change the bucket name to end with -encrypted and treat the naming convention as cryptographic evidence.
- Inspect relevant S3 encryption metadata, enforce bucket/key policies and use supported AWS audit or configuration evidence without exposing plaintext key material.
Explanation
Correct Answer
D:S3 can report server-side encryption attributes and AWS tools can evaluate policy. KMS-managed key material is not meant to be copied into application source to prove encryption.
Incorrect Answers
A:Standard KMS-managed key material is not exported as a plaintext secret through ordinary key-management APIs. Embedding secrets would also violate the protection objective.
B:Versioning preserves historical object versions and does not prove correct encryption key selection or access restriction.
C:Resource names are not proof of actual server-side encryption configuration, KMS key use or authorization.
Question 311
A mobile analytics application encrypts customer records using one master key stored as a string in its source code. The architect needs centrally governed key use and per-record data encryption without embedding the master secret in binaries. Which design fits?
- Put the master key in a public S3 bucket so all application clients share one consistent value.
- Use AWS KMS-backed envelope encryption so data keys protect records and the KMS key protects the data-key lifecycle.
- Use Route 53 latency routing to determine which cryptographic key each record should use.
- Continue using the hardcoded master key and rename the source file to avoid code search tools.
Explanation
Correct Answer
B:Envelope encryption encrypts bulk data with a data key and stores that key only in encrypted form under a KMS key. AWS authorization and audit can control key usage.
Incorrect Answers
A:Public key material would destroy confidentiality and bypass the centrally managed authorization requirement.
C:DNS routing selects endpoints and is not a secure encryption key management or envelope-encryption workflow.
D:Renaming source files does not protect embedded key material against source disclosure, build artifacts or a compromised runtime.
Question 312
An application implements envelope encryption with a customer-managed KMS key. It needs fresh plaintext data-key material to encrypt a new object and later must decrypt a stored encrypted data key. Which API distinction is correct?
- Use S3 lifecycle transitions to reveal the original plaintext data key when an object is retrieved.
- Use KMS DescribeKey as the operation that returns arbitrary plaintext data keys for all stored objects.
- Use GenerateDataKey for a new plaintext/encrypted data-key pair and KMS Decrypt when recovering the protected data key.
- Use KMS ScheduleKeyDeletion each time data is encrypted to rotate its plaintext data key.
Explanation
Correct Answer
C:GenerateDataKey supplies fresh data-key material for local encryption and a KMS-protected form for storage. Decrypt unwraps an authorized encrypted data key for later use.
Incorrect Answers
A:Storage-class lifecycle processing is not a KMS data-key decrypt operation and cannot supply the missing key material.
B:DescribeKey reports key metadata and is not the cryptographic operation for generating or unwrapping a data key.
D:Scheduling master-key deletion threatens all ciphertext relying on that key and is unrelated to per-object data-key generation.
Question 313
A security organization wants separate IAM roles for administering KMS key policy and for an application decrypting specific records. A developer suggests giving the application full key administration to avoid errors. Which separation is appropriate?
- Give the application kms:* including ScheduleKeyDeletion because it can decrypt data only with full administrative rights.
- Use key-policy and IAM grants that distinguish key administrators from narrowly authorized cryptographic-use principals.
- Store the KMS key ID in CloudWatch metrics and treat that as a complete access policy.
- Disable all key policies and rely on VPC security groups to authorize cryptographic API calls.
Explanation
Correct Answer
B:KMS key administration and Encrypt/Decrypt operations can be scoped to different roles. Keeping applications out of policy modification or deletion reduces the impact of credential compromise.
Incorrect Answers
A:Cryptographic use does not require permission to change or delete the key. Broad management rights are unnecessary and dangerous.
C:Key metadata in metrics does not determine who may use or administer the key. Explicit authorization remains required.
D:KMS authorization uses key and IAM policies, not ENI packet filtering as its substitute.
Question 314
A service encrypts millions of small events using envelope encryption. It proposes calling KMS for every payload byte and using one KMS API request per tiny chunk, creating unnecessary cost and throttling risk. How should it scale encryption?
- Use appropriately scoped data-key reuse or batching and respect KMS API quotas while retaining the required cryptographic security properties.
- Embed the KMS master key's plaintext material in every client binary so no API authorization is needed.
- Convert events into S3 Glacier Deep Archive objects before encrypting them, which bypasses all KMS limits automatically.
- Increase the KMS request rate indefinitely because every KMS key has unlimited API throughput by definition.
Explanation
Correct Answer
A:KMS typically protects or generates data keys, while application cryptographic libraries encrypt bulk payloads. Reducing unnecessary KMS calls can preserve throughput within quotas.
Incorrect Answers
B:Hardcoding master material defeats KMS custody and access controls and creates widespread exposure risk.
C:Storage archive choices do not eliminate required KMS cryptographic operations in an application envelope-encryption design.
D:KMS cryptographic operations have request quotas, so unbounded per-byte calls can throttle and increase cost.
Question 315
A security policy requires periodic rotation of symmetric KMS key material for a supported customer-managed KMS key without changing its logical key ID. Which option should the architect choose?
- Change every object's S3 storage class and assume the new class creates a new KMS logical key.
- Delete the KMS key immediately every month to force all encrypted datasets to regenerate themselves.
- Enable the supported automatic or on-demand KMS key-material rotation mechanism appropriate to the key type and policy.
- Create a second KMS key each month and change only an alias while assuming existing ciphertext is transparently reencrypted under the new key material.
Explanation
Correct Answer
C:KMS supports rotation for eligible customer-managed symmetric keys while keeping the logical key identity. The service retains earlier material for existing ciphertext decryption.
Incorrect Answers
A:Storage-class transitions do not implement the required KMS key-material rotation or guarantee new logical keys.
B:Key deletion would make dependent ciphertext unrecoverable after the waiting period if not migrated. It is not normal material rotation.
D:Alias reassignment changes the destination for future encryption calls, not the KMS key ID stored in prior ciphertext. Automatic or on-demand rotation retains logical key continuity and decryptability for old data keys.
Question 316
A company enables automatic material rotation for an eligible symmetric customer-managed KMS key. A developer fears old encrypted S3 and application data will immediately become undecipherable because the key material changes. Which explanation is accurate?
- All earlier ciphertext becomes unreadable the instant automatic rotation is enabled.
- Rotation transparently re-encrypts every existing object and database row as a single mandatory bulk job.
- AWS KMS publishes every old plaintext key to CloudTrail so applications can decrypt without IAM.
- KMS retains the necessary previous key material for existing ciphertext, so rotation does not automatically break prior decryption.
Explanation
Correct Answer
D:KMS rotation changes the active key material for new encryption while preserving the ability to decrypt older protected data through the same logical key ID.
Incorrect Answers
A:Supported KMS rotation preserves old material specifically so historical ciphertext remains decryptable by authorized callers.
B:Key-material rotation is not an automatic blanket re-encryption of all application data. Data migration is a distinct workflow.
C:CloudTrail records API activity rather than exposing plaintext cryptographic key material. Authorized KMS decrypt remains required.
Question 317
A regulator orders a bank to stop using a particular KMS logical key ID and re-encrypt all retained records under a newly approved key. Engineers suggest simply rotating the old key material because the ARN will stay unchanged. What is the correct migration?
- Disable CloudTrail so the old key's API calls are no longer visible to the regulator.
- Move all ciphertext to S3 Standard-IA and assume a different storage class implies a new KMS master key.
- Enable automatic material rotation on the old key and report that every data object now uses a different logical key ID.
- Create and authorize a new KMS key and explicitly re-encrypt or migrate affected data to that new logical key.
Explanation
Correct Answer
D:Material rotation retains the same logical key identity; a policy requiring a new key ARN needs explicit migration of dependent ciphertext and an approved cutover plan.
Incorrect Answers
A:Suppressing audit events does not re-encrypt data and undermines the required migration evidence.
B:Storage class selection does not rewrite the logical KMS key protecting the objects.
C:Rotating material does not change the original KMS key ID, so it cannot satisfy a requirement for a new logical identity.
Question 318
A company brings externally generated key material into AWS KMS and also uses asymmetric keys for digital signatures. A team assumes every key can enable the same automatic symmetric-key material rotation setting. What qualification is correct?
- Check the key origin and key type; automatic rotation eligibility differs for KMS-managed symmetric keys, imported material and asymmetric keys.
- Convert a digital-signature verification key into an S3 bucket ACL to inherit symmetric key-rotation settings.
- Enable symmetric KMS automatic rotation on every asymmetric key and imported-material key without checking eligibility.
- Treat an imported-key-material expiration as the same process as data-key rotation under AWS-managed KMS material.
Explanation
Correct Answer
A:AWS KMS rotation capabilities depend on key spec and material origin. Imported key-material expiry and asymmetric cryptography require separately planned lifecycle controls.
Incorrect Answers
B:An S3 ACL governs access, not cryptographic key type or KMS key-material lifecycle.
C:Unsupported key types and external origins do not all share the standard AWS-managed symmetric rotation workflow.
D:Expiration or replacement of imported material has distinct operational consequences and may affect decryptability.
Question 319
A central compliance account receives S3 documents from vendor AWS accounts. The uploaders previously used object ACLs, which have caused ownership disputes and inconsistent access. The control now requires the central bucket owner to own every object and to enforce access exclusively through policies, with ACLs no longer used for authorization. Some clients still try to send a public-read ACL on PutObject. Which configuration and migration step satisfy the control?
- Select Object writer ownership and continue allowing each vendor to manage the object ACL, because central bucket policies alone transfer ownership.
- Set S3 Object Ownership to Bucket owner enforced, update clients to omit incompatible ACLs (or use the permitted bucket-owner-full-control form), and grant needed access through policies.
- Select Bucket owner preferred and leave public-read object ACLs active, because this disables all ACL-based authorization.
- Turn on S3 Versioning and require all vendors to upload the same key name, because version history automatically changes object ownership and disables ACLs.
Explanation
Correct Answer
B:Bucket owner enforced gives the bucket owner control over all objects and disables ACLs for authorization. Uploads must omit ACLs or use accepted bucket-owner-full-control semantics; a public-read ACL is rejected, and access is governed by identity/bucket policies.
Incorrect Answers
A:Object writer leaves the uploading account owning its objects and permits ACL-based grants. It contradicts the required central ownership and ACL-free access model.
C:Bucket owner preferred can change ownership for qualifying uploads but leaves ACLs enabled; it does not meet the stated requirement to remove ACL evaluation entirely.
D:Versioning provides object history and restore options, not a substitute for S3 Object Ownership. It neither disables ACLs nor ensures the bucket owner owns cross-account uploads.
Question 320
A security team inherits an S3 bucket with an existing bucket policy that allows anonymous GetObject. They enable the BlockPublicPolicy setting and assume that it immediately neutralizes the old policy, but the bucket remains readable anonymously. No legitimate cross-account access is required. Which specific S3 Block Public Access control directly restricts access through the existing public policy?
- Enable BlockPublicAcls; it retroactively disables all permissions granted by bucket policies.
- Enable IgnorePublicAcls; it overrides existing public bucket-policy statements as well as ACLs.
- Enable RestrictPublicBuckets, then remove the public policy grant and verify the effective bucket-access configuration.
- Run BlockPublicPolicy again without changing any other setting; repeating it revokes the already stored public policy.
Explanation
Correct Answer
C:RestrictPublicBuckets limits a bucket with a public policy to authorized same-account users and AWS service principals, including restricting cross-account access. Remove the offending public policy as the durable correction and verify the intended access.
Incorrect Answers
A:BlockPublicAcls blocks new public ACL grants and certain public-ACL writes. ACL controls do not retroactively nullify an existing public bucket policy.
B:IgnorePublicAcls makes public ACL grants ineffective, but it does not negate an existing public Allow in a bucket policy.
D:BlockPublicPolicy rejects new public bucket-policy writes but does not change existing policy statements. Reapplying it alone cannot satisfy a requirement to restrict a legacy public policy.
