Amazon AWS SAA-C03 Encryption, KMS, Key Policies, Certificates, and Data Protection Practice Test 3

 

Topic 05 Practice Test 3 covers Encryption, KMS, Key Policies, Certificates, and Data Protection for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

A new S3 general purpose bucket has no legacy SSE-C objects. An application team proposes SSE-C for a new workload in 2026. Which design is more aligned with the current S3 default posture and centralized key management?

  1. Put the customer encryption key in object tags
  2. Assume SSE-C is enabled by default and send raw keys with every request
  3. Use SSE-KMS with an AWS KMS key for the new workload
  4. Disable all S3 server-side encryption

Correct Answer(s)

 

C

Rationale

  1. Object tags are metadata and must never be used to store plaintext encryption keys that unlock the object itself. Context cue: design is more aligned with the current S3. Required outcome instead: use SSE-KMS instead of introducing SSE-C key handling. Constraint check: new 2026 bucket.
  2. SSE-C now requires deliberate enabling in affected buckets and obligates clients to supply the encryption key on each relevant request. Context cue: SSE-C objects. An application team proposes SSE-C for. Required outcome instead: use SSE-KMS instead of introducing SSE-C key handling. Constraint check: new 2026 bucket.
  3. Current S3 defaults disable SSE-C for new general purpose buckets, while SSE-KMS provides managed key authorization and avoids passing raw customer keys with every object request. Context cue: S3 general purpose bucket has no legacy SSE-C. Required outcome: use SSE-KMS instead of introducing SSE-C key handling.
  4. All S3 objects already receive baseline server-side encryption, and disabling protection would conflict with the security objective rather than modernize it. Context cue: for a new workload in 2026. Which design. Required outcome instead: use SSE-KMS instead of introducing SSE-C key handling. Constraint check: centralized key management.

 

Question 2

An S3 workload is satisfied with baseline encryption at rest and has no requirement for customer-managed key policies. What protection is automatically applied to new objects by S3?

  1. Server-side encryption with Amazon S3 managed keys (SSE-S3)
  2. No encryption unless a PUT header is supplied
  3. DSSE-KMS for every object by default
  4. SSE-C with an AWS-provided customer key

Correct Answer(s)

 

A

Rationale

  1. S3 automatically encrypts new objects with SSE-S3 as the baseline default when a different bucket encryption configuration is not selected. Context cue: and has no requirement for customer-managed key policies.. Required outcome: S3 automatically applies SSE-S3 as the baseline default encryption. Constraint check: baseline only.
  2. Modern S3 does not leave new object uploads unencrypted merely because the client omitted an encryption header. Context cue: policies. What protection is automatically applied to new. Required outcome instead: S3 automatically applies SSE-S3 as the baseline default encryption. Constraint check: no custom key policy.
  3. DSSE-KMS is an optional dual-layer control with KMS cost and configuration; it is not the universal S3 default. Context cue: satisfied with baseline encryption at rest and has. Required outcome instead: S3 automatically applies SSE-S3 as the baseline default encryption. Constraint check: baseline only.
  4. SSE-C requires customer-provided key material and is not automatically supplied or managed by AWS for each object. Context cue: has no requirement for customer-managed key policies. What. Required outcome instead: S3 automatically applies SSE-S3 as the baseline default encryption. Constraint check: no custom key policy.

 

Question 3

A compliance rule mandates two independent KMS-backed layers for S3 data and accepts extra processing and KMS calls. What trade-off should the architect expect from DSSE-KMS?

  1. Expect DSSE-KMS to cost less than SSE-S3
  2. Assume DSSE-KMS removes the need for any KMS permissions
  3. Expect S3 Bucket Keys to eliminate DSSE-KMS KMS calls
  4. Use DSSE-KMS and budget for its additional KMS activity and processing overhead

Correct Answer(s)

 

D

Rationale

  1. Dual-layer KMS encryption is a stronger specialized control and is not designed as a lower-cost replacement for the S3 managed-key baseline. Context cue: extra processing and KMS calls. What trade-off should. Required outcome instead: DSSE-KMS provides two layers but increases KMS calls and processing overhead.
  2. KMS-backed server-side encryption still depends on appropriate key authorization; the second layer does not remove KMS permissions requirements. Context cue: rule mandates two independent KMS-backed layers for S3. Required outcome instead: DSSE-KMS provides two layers but increases KMS calls and processing overhead. Constraint check: dual layer.
  3. S3 Bucket Keys are not supported for DSSE-KMS, so they cannot be used to collapse the dual-layer KMS request pattern. Context cue: KMS-backed layers for S3 data and accepts extra. Required outcome instead: DSSE-KMS provides two layers but increases KMS calls and processing overhead. Constraint check: dual layer.
  4. DSSE-KMS adds an independent second server-side encryption layer, and that stronger control carries additional processing and KMS API activity compared with standard SSE-KMS. Context cue: calls. What trade-off should the architect expect from. Required outcome: DSSE-KMS provides two layers but increases KMS calls and processing overhead.

 

Question 4

A company has a long-lived ACM DNS validation CNAME for example.com. It requests another certificate for the same domain after deleting the prior certificate. What should it generally do with the validation record?

  1. Remove the record immediately to force email validation
  2. Leave the existing ACM DNS validation CNAME in place
  3. Create a new hosted zone for every certificate
  4. Replace the CNAME with an A record to the certificate ARN

Correct Answer(s)

 

B

Rationale

  1. Deleting the working CNAME removes the reusable validation path and may create unnecessary manual validation work. Context cue: the same domain after deleting the prior certificate.. Required outcome instead: keep and reuse the ACM DNS CNAME because the token remains valid for the domain. Constraint check: existing CNAME.
  2. ACM DNS validation records can continue proving control of the same domain, supporting replacement certificates and managed renewal without repeated manual validation. Context cue: deleting the prior certificate. What should it generally. Required outcome: keep and reuse the ACM DNS CNAME because the token remains valid for the domain.
  3. Creating multiple hosted zones is unrelated to certificate validation and can introduce conflicting DNS authority rather than simplify certificate lifecycle. Context cue: has a long-lived ACM DNS validation CNAME for. Required outcome instead: keep and reuse the ACM DNS CNAME because the token remains valid for the domain.
  4. Certificate ARNs are not IP addresses and cannot be targets of ordinary A records used to validate domain ownership. Context cue: for example.com. It requests another certificate for the. Required outcome instead: keep and reuse the ACM DNS CNAME because the token remains valid for the domain.

 

Question 5

A 3 KB secret value is stored as a standard Systems Manager Parameter Store SecureString. How does Parameter Store protect the value with KMS?

  1. It always uses the AWS Encryption SDK envelope format used by advanced parameters
  2. It requires an asymmetric KMS key
  3. It stores the value in plaintext and encrypts only the parameter name
  4. It calls AWS KMS Encrypt directly using the selected symmetric KMS key

Correct Answer(s)

 

D

Rationale

  1. Advanced SecureString parameters use the AWS Encryption SDK and envelope encryption; that is not the standard-tier behavior described here. Context cue: a standard Systems Manager Parameter Store SecureString. How. Required outcome instead: standard SecureString uses KMS Encrypt directly with a symmetric key. Constraint check: standard tier.
  2. Parameter Store supports symmetric KMS keys for SecureString and does not accept asymmetric KMS keys for this purpose. Context cue: How does Parameter Store protect the value with. Required outcome instead: standard SecureString uses KMS Encrypt directly with a symmetric key. Constraint check: 3 KB value.
  3. The sensitive parameter value is what receives KMS protection; names and other metadata are not substituted for value encryption. Context cue: stored as a standard Systems Manager Parameter Store. Required outcome instead: standard SecureString uses KMS Encrypt directly with a symmetric key. Constraint check: standard tier.
  4. Standard SecureString values are small enough for Parameter Store to call KMS Encrypt directly with the configured symmetric KMS key. Context cue: 3 KB secret value is stored as a. Required outcome: standard SecureString uses KMS Encrypt directly with a symmetric key. Constraint check: 3 KB value.

 

Question 6

A 7 KB configuration secret must be stored as an advanced Parameter Store SecureString. Which protection model is used?

  1. Use an asymmetric signing key in KMS
  2. Use an advanced SecureString, which applies envelope encryption with the AWS Encryption SDK and KMS
  3. Disable KMS and rely on TLS only
  4. Store it as a standard SecureString because standard has no size limit

Correct Answer(s)

 

B

Rationale

  1. Signing keys prove authenticity rather than provide the supported symmetric SecureString encryption workflow required by Parameter Store. Context cue: KB configuration secret must be stored as an. Required outcome instead: advanced SecureString uses envelope encryption through the AWS Encryption SDK. Constraint check: advanced tier.
  2. Advanced SecureString values use the AWS Encryption SDK with a unique data key protected by KMS, providing envelope encryption for the stored parameter. Context cue: advanced Parameter Store SecureString. Which protection model is. Required outcome: advanced SecureString uses envelope encryption through the AWS Encryption SDK.
  3. TLS protects transport but does not replace required at-rest protection for the sensitive parameter value. Context cue: an advanced Parameter Store SecureString. Which protection model. Required outcome instead: advanced SecureString uses envelope encryption through the AWS Encryption SDK. Constraint check: 7 KB secret.
  4. Standard Parameter Store values have a smaller size limit and cannot simply absorb a 7 KB secret while remaining standard tier. Context cue: be stored as an advanced Parameter Store SecureString.. Required outcome instead: advanced SecureString uses envelope encryption through the AWS Encryption SDK. Constraint check: 7 KB secret.

 

Question 7

An architect is selecting a KMS key for a Parameter Store SecureString. Which key characteristic is mandatory?

  1. Use a symmetric encryption KMS key
  2. Use a CloudFront public key
  3. Use an asymmetric RSA signing key
  4. Use an HMAC KMS key only

Correct Answer(s)

 

A

Rationale

  1. Parameter Store SecureString encryption is implemented with symmetric KMS keys, whether using the AWS managed key or a customer managed key. Context cue: architect is selecting a KMS key for a. Required outcome: Parameter Store SecureString requires a symmetric KMS key. Constraint check: key compatibility.
  2. CloudFront public keys participate in edge encryption features and are unrelated to Parameter Store KMS encryption. Context cue: a KMS key for a Parameter Store SecureString.. Required outcome instead: Parameter Store SecureString requires a symmetric KMS key. Constraint check: SecureString.
  3. An asymmetric signing key is for digital signatures and is not a supported SecureString encryption key type in Parameter Store. Context cue: a Parameter Store SecureString. Which key characteristic is. Required outcome instead: Parameter Store SecureString requires a symmetric KMS key. Constraint check: SecureString.
  4. HMAC keys generate and verify message authentication codes; they are not the supported key type for Parameter Store value encryption. Context cue: key for a Parameter Store SecureString. Which key. Required outcome instead: Parameter Store SecureString requires a symmetric KMS key. Constraint check: key compatibility.

 

Question 8

A team must share a Parameter Store SecureString across AWS accounts using AWS RAM. What combination is required for the shared parameter?

  1. Use a standard SecureString with the default aws/ssm key
  2. Use a String parameter with the secret base64-encoded
  3. Use an advanced SecureString with a customer managed KMS key, then grant the recipient access to that key
  4. Use an AWS managed KMS key and assume it is shareable

Correct Answer(s)

 

C

Rationale

  1. Standard parameters are not eligible for this sharing model, and the default aws/ssm managed key is not a cross-account customer-controlled key. Context cue: AWS accounts using AWS RAM. What combination is. Required outcome instead: use an advanced-tier SecureString encrypted with a customer managed KMS key and share the key separately.
  2. Base64 does not encrypt sensitive data and changing the parameter type would remove SecureString protection. Context cue: must share a Parameter Store SecureString across AWS. Required outcome instead: use an advanced-tier SecureString encrypted with a customer managed KMS key and share the key separately. Constraint check: AWS RAM share.
  3. Cross-account Parameter Store sharing requires advanced-tier parameters, and a shared SecureString must use a customer managed key whose access is granted separately. Context cue: must share a Parameter Store SecureString across AWS. Required outcome: use an advanced-tier SecureString encrypted with a customer managed KMS key and share the key separately.
  4. AWS managed keys are controlled by AWS services and are not shared across accounts like customer managed KMS keys. Context cue: AWS accounts using AWS RAM. What combination is. Required outcome instead: use an advanced-tier SecureString encrypted with a customer managed KMS key and share the key separately.

 

Question 9

A Lambda function needs an RDS password that must rotate automatically. The developer proposes storing the password directly in a Lambda environment variable. What is the preferred design?

  1. Put the password in a plain String Parameter Store parameter
  2. Store the RDS credential in AWS Secrets Manager with rotation enabled
  3. Embed the password in the deployment package
  4. Keep the password in an environment variable and rotate only the Lambda KMS key

Correct Answer(s)

 

B

Rationale

  1. A plain String parameter is not an appropriate store for sensitive credentials because it lacks SecureString encryption protection. Context cue: a Lambda environment variable. What is the preferred. Required outcome instead: store the database credential in Secrets Manager and retrieve it at runtime. Constraint check: automatic rotation.
  2. AWS recommends Secrets Manager for database credentials because it is purpose-built for secrets and supports coordinated credential rotation, while Lambda can retrieve the current value. Context cue: RDS password that must rotate automatically. The developer. Required outcome: store the database credential in Secrets Manager and retrieve it at runtime.
  3. Embedding a password in deployment artifacts creates static secret exposure and makes rotation operationally difficult. Context cue: password that must rotate automatically. The developer proposes. Required outcome instead: store the database credential in Secrets Manager and retrieve it at runtime. Constraint check: RDS password.
  4. Changing the KMS key that protects an environment variable does not change the database password, so credential rotation would still be missing. Context cue: developer proposes storing the password directly in a. Required outcome instead: store the database credential in Secrets Manager and retrieve it at runtime.

 

Question 10

A Secrets Manager Lambda rotation succeeds. Which version-label transition indicates completion?

  1. Rename the secret ARN after each rotation
  2. Leave AWSPENDING on the old version forever
  3. Promote the tested version to AWSCURRENT; the former current version becomes AWSPREVIOUS
  4. Delete every previous secret version before promotion

Correct Answer(s)

 

C

Rationale

  1. The secret ARN remains the stable resource identifier across version changes; rotation operates on versions and staging labels. Context cue: Secrets Manager Lambda rotation succeeds. Which version-label transition. Required outcome instead: move AWSCURRENT to the new version and mark the former current version AWSPREVIOUS. Constraint check: version labels.
  2. AWSPENDING represents an in-progress candidate and should not be left as the only durable state of the old version after successful completion. Context cue: Manager Lambda rotation succeeds. Which version-label transition indicates. Required outcome instead: move AWSCURRENT to the new version and mark the former current version AWSPREVIOUS.
  3. The finish step moves AWSCURRENT to the successfully tested new version, while Secrets Manager labels the former current version AWSPREVIOUS for rollback context. Context cue: Secrets Manager Lambda rotation succeeds. Which version-label transition. Required outcome: move AWSCURRENT to the new version and mark the former current version AWSPREVIOUS.
  4. Immediate deletion of prior versions removes useful recovery context and is not how Secrets Manager marks a completed rotation. Context cue: A Secrets Manager Lambda rotation succeeds. Which version-label. Required outcome instead: move AWSCURRENT to the new version and mark the former current version AWSPREVIOUS.

 

Question 11

A role has a grant on the primary member of a KMS multi-Region key set. It now needs to decrypt with the replica in another Region. What should be added?

  1. Nothing; the primary grant is global
  2. An S3 presigned URL for the key
  3. A Route 53 record pointing to the primary key ARN
  4. Create a separate KMS grant on the replica key

Correct Answer(s)

 

D

Rationale

  1. The primary grant does not become a global authorization object across related regional KMS resources. Context cue: with the replica in another Region. What should. Required outcome instead: create a grant on the replica key because grants are regional and key-specific. Constraint check: grant on primary.
  2. Presigned URLs apply to services such as S3 and cannot grant cryptographic operations on a KMS replica. Context cue: on the primary member of a KMS multi-Region. Required outcome instead: create a grant on the replica key because grants are regional and key-specific. Constraint check: decrypt replica.
  3. DNS records cannot delegate KMS authorization and have no role in key-policy or grant evaluation. Context cue: multi-Region key set. It now needs to decrypt. Required outcome instead: create a grant on the replica key because grants are regional and key-specific. Constraint check: grant on primary.
  4. KMS grants authorize one KMS key in one Region, so the replica needs its own grant even though it is related to the primary. Context cue: key set. It now needs to decrypt with. Required outcome: create a grant on the replica key because grants are regional and key-specific.

 

Question 12

A multi-Region KMS replica is created in eu-central-1 from a primary in us-east-1. Which identifier remains the same between the related keys?

  1. The multi-Region key ID
  2. The Region component of the ARN
  3. The key policy document automatically
  4. The complete key ARN

Correct Answer(s)

 

A

Rationale

  1. Related multi-Region keys use the same key ID, which helps identify them as members of one set, while each regional resource has a distinct ARN. Context cue: from a primary in us-east-1. Which identifier remains. Required outcome: related multi-Region keys share the same key ID while their ARNs differ by Region.
  2. The Region component must differ because the two KMS resources exist in different AWS Regions. Context cue: from a primary in us-east-1. Which identifier remains. Required outcome instead: related multi-Region keys share the same key ID while their ARNs differ by Region. Constraint check: primary and replica.
  3. Key policies are regional configuration and are not simply copied as an always-identical shared property across the related keys. Context cue: multi-Region KMS replica is created in eu-central-1 from. Required outcome instead: related multi-Region keys share the same key ID while their ARNs differ by Region.
  4. The full ARN includes Region and therefore differs between the primary and a replica located elsewhere. Context cue: multi-Region KMS replica is created in eu-central-1 from. Required outcome instead: related multi-Region keys share the same key ID while their ARNs differ by Region. Constraint check: identifier.

 

Question 13

A security engineer assumes the key policy on a multi-Region primary will automatically govern its replica in another Region. What is the safer design assumption?

  1. Review and configure the replica key policy in its own Region
  2. Rely only on an S3 object ACL to authorize KMS
  3. Treat one key policy as a global policy for all replicas
  4. Use a CloudFront distribution policy instead

Correct Answer(s)

 

A

Rationale

  1. KMS key policies are regional resource policies, so authorization should be reviewed for each primary or replica key resource rather than assumed to be global. Context cue: primary will automatically govern its replica in another. Required outcome: manage authorization for each regional KMS key resource and verify its key policy independently.
  2. S3 ACLs address object permissions and do not grant cryptographic access to a KMS key. Context cue: its replica in another Region. What is the. Required outcome instead: manage authorization for each regional KMS key resource and verify its key policy independently. Constraint check: multi-Region key set.
  3. A policy attached to one regional KMS key does not serve as a universal resource policy for every related key in other Regions. Context cue: A security engineer assumes the key policy on. Required outcome instead: manage authorization for each regional KMS key resource and verify its key policy independently.
  4. CloudFront distribution policies govern edge delivery behavior and cannot substitute for KMS key authorization. Context cue: on a multi-Region primary will automatically govern its. Required outcome instead: manage authorization for each regional KMS key resource and verify its key policy independently. Constraint check: authorization.

 

Question 14

A customer managed multi-Region symmetric key generated by KMS needs routine automatic rotation. Which operation pattern is correct?

  1. Schedule separate automatic rotations on replicas
  2. Replace the key alias daily
  3. Export the primary key material and import it manually into replicas
  4. Enable automatic key rotation on the primary multi-Region key

Correct Answer(s)

 

D

Rationale

  1. Replica-specific automatic schedules are not the management model for this shared property of a related multi-Region key set. Context cue: by KMS needs routine automatic rotation. Which operation. Required outcome instead: enable automatic rotation on the primary key and let KMS synchronize shared key material versions.
  2. Alias changes only alter name resolution and do not rotate key material protected inside KMS. Context cue: symmetric key generated by KMS needs routine automatic. Required outcome instead: enable automatic rotation on the primary key and let KMS synchronize shared key material versions. Constraint check: AWS_KMS origin.
  3. AWS-generated KMS key material is not exported for manual propagation, and KMS already manages supported multi-Region synchronization. Context cue: customer managed multi-Region symmetric key generated by KMS. Required outcome instead: enable automatic rotation on the primary key and let KMS synchronize shared key material versions.
  4. For AWS-generated multi-Region key material, the automatic-rotation setting is controlled at the primary and KMS makes the resulting versions available to related replicas. Context cue: A customer managed multi-Region symmetric key generated by. Required outcome: enable automatic rotation on the primary key and let KMS synchronize shared key material versions.

 

Question 15

A team wants client-provided S3 encryption keys for a new general purpose bucket but discovers SSE-C requests are rejected by default. What explains the behavior in the current S3 model?

  1. The KMS key is in the wrong Region
  2. CloudFront must be enabled before SSE-C works
  3. The bucket uses the current default that blocks SSE-C until it is deliberately enabled
  4. S3 no longer supports any server-side encryption

Correct Answer(s)

 

C

Rationale

  1. SSE-C uses client-supplied keys rather than a KMS key, so a KMS Region mismatch does not explain the default rejection. Context cue: client-provided S3 encryption keys for a new general. Required outcome instead: SSE-C is disabled by default for new general purpose buckets and must be explicitly enabled if truly required.
  2. CloudFront is an edge-delivery service and is unrelated to whether the S3 bucket accepts SSE-C object requests. Context cue: general purpose bucket but discovers SSE-C requests are. Required outcome instead: SSE-C is disabled by default for new general purpose buckets and must be explicitly enabled if truly required.
  3. Current S3 behavior blocks SSE-C by default for new general purpose buckets, so teams must deliberately enable it rather than receiving it implicitly. Context cue: purpose bucket but discovers SSE-C requests are rejected. Required outcome: SSE-C is disabled by default for new general purpose buckets and must be explicitly enabled if truly required.
  4. S3 still supports multiple server-side encryption modes, including SSE-S3, SSE-KMS, DSSE-KMS, and explicitly enabled SSE-C where applicable. Context cue: rejected by default. What explains the behavior in. Required outcome instead: SSE-C is disabled by default for new general purpose buckets and must be explicitly enabled if truly required.

 

Question 16

A security team wants a new S3 bucket to use a customer managed KMS key because it needs custom key policies and rotation control. Which statement distinguishes this from the S3 baseline?

  1. SSE-S3 lets the customer edit a KMS key policy
  2. Configure SSE-KMS because the default SSE-S3 baseline does not expose a customer-managed KMS policy
  3. S3 objects are unencrypted unless SSE-KMS is selected
  4. SSE-KMS disables all server-side encryption

Correct Answer(s)

 

B

Rationale

  1. SSE-S3 uses S3-managed keys rather than a customer managed KMS key whose policy the customer can edit. Context cue: KMS key because it needs custom key policies. Required outcome instead: SSE-S3 is automatic baseline encryption, while SSE-KMS is selected when customer KMS control is needed.
  2. S3 supplies SSE-S3 baseline encryption automatically, but SSE-KMS is the appropriate selection when governance requires a customer managed key and its policy controls. Context cue: it needs custom key policies and rotation control.. Required outcome: SSE-S3 is automatic baseline encryption, while SSE-KMS is selected when customer KMS control is needed.
  3. New S3 objects are already protected by baseline server-side encryption, so choosing SSE-KMS is about stronger key governance rather than adding the first encryption layer. Context cue: control. Which statement distinguishes this from the S3. Required outcome instead: SSE-S3 is automatic baseline encryption, while SSE-KMS is selected when customer KMS control is needed.
  4. SSE-KMS is itself a server-side encryption mode and does not disable encryption when configured. Context cue: S3 bucket to use a customer managed KMS. Required outcome instead: SSE-S3 is automatic baseline encryption, while SSE-KMS is selected when customer KMS control is needed. Constraint check: custom key policy.

 

Question 17

A regulated S3 archive enables DSSE-KMS. The architect also tries to enable S3 Bucket Keys to lower KMS cost. What constraint should be recognized?

  1. Bucket Keys are mandatory for DSSE-KMS
  2. DSSE-KMS requires SSE-C underneath
  3. Do not plan on S3 Bucket Keys for DSSE-KMS objects
  4. DSSE-KMS works only on unversioned buckets

Correct Answer(s)

 

C

Rationale

  1. Bucket Keys are optional optimizations for standard SSE-KMS and are not a prerequisite for dual-layer encryption. Context cue: enables DSSE-KMS. The architect also tries to enable. Required outcome instead: S3 Bucket Keys are not supported with DSSE-KMS. Constraint check: dual layer.
  2. DSSE-KMS uses AWS KMS for both server-side layers and does not require customer-provided SSE-C keys. Context cue: enable S3 Bucket Keys to lower KMS cost.. Required outcome instead: S3 Bucket Keys are not supported with DSSE-KMS. Constraint check: cost optimization.
  3. DSSE-KMS uses its dual KMS-backed encryption design without S3 Bucket Key support, so the cost optimization cannot be combined with this mode. Context cue: Bucket Keys to lower KMS cost. What constraint. Required outcome: S3 Bucket Keys are not supported with DSSE-KMS. Constraint check: cost optimization.
  4. S3 versioning state is independent of whether dual-layer KMS encryption can be used for an object. Context cue: S3 archive enables DSSE-KMS. The architect also tries. Required outcome instead: S3 Bucket Keys are not supported with DSSE-KMS. Constraint check: dual layer.

 

Question 18

A company wants one ACM-issued public TLS certificate for an AWS load balancer and an on-premises reverse proxy. The existing ACM certificate was requested with export disabled, but the on-premises host must receive the certificate private key. What should the solutions architect do?

  1. Use GetCertificate on the existing ACM certificate and copy the returned private key to the on-premises proxy
  2. Request a new ACM public certificate with export enabled, validate it, and export the certificate, chain, and encrypted private key
  3. Keep the existing non-exportable certificate and copy the load balancer TLS private key from the AWS service
  4. Update the existing ACM certificate to enable export and then export its private key

Correct Answer(s)

 

B

Rationale

  1. Retrieving an ACM certificate does not make a non-exportable private key available for customer installation. The requirement specifically needs private-key material outside the managed AWS integration. The architect therefore needs an ACM public certificate created as exportable, followed by the supported export operation with a passphrase.
  2. ACM can issue exportable public certificates for use both with integrated AWS services and on customer-managed infrastructure. Export must be enabled when the new certificate is requested. After validation and issuance, the architect can export the certificate, chain, and passphrase-protected private key for deployment on the on-premises proxy.
  3. Integrated AWS services do not expose the private key of a non-exportable ACM certificate for copying to external hosts. Reusing that managed key on the on-premises proxy is therefore not possible. The architect should request a new ACM public certificate with export enabled and securely export its private-key material.
  4. The export setting for an ACM public certificate cannot be changed after that certificate is created. Because the existing certificate was requested with export disabled, enabling export later is not a valid recovery path. A new exportable public certificate must be requested and validated before its private key can be exported.

 

Question 19

An organization must ensure all newly created EFS file systems are encrypted at rest. Which IAM control can help enforce this during creation?

  1. Require elasticfilesystem:Encrypted to be true in the relevant IAM policy
  2. Set aws:SecureTransport to false
  3. Require s3:x-amz-server-side-encryption
  4. Use kms:ViaService with CloudFront only

Correct Answer(s)

 

A

Rationale

  1. The elasticfilesystem:Encrypted condition key can be used in IAM policies to prevent creation of EFS file systems that are not encrypted at rest. Context cue: are encrypted at rest. Which IAM control can. Required outcome: use the elasticfilesystem:Encrypted condition key in an IAM policy. Constraint check: enforce encryption.
  2. aws:SecureTransport concerns TLS transport and setting it false would weaken, not enforce, encryption expectations. Context cue: organization must ensure all newly created EFS file. Required outcome instead: use the elasticfilesystem:Encrypted condition key in an IAM policy. Constraint check: new EFS file systems.
  3. The S3 server-side encryption request key applies to S3 object operations and does not govern EFS file-system creation. Context cue: must ensure all newly created EFS file systems. Required outcome instead: use the elasticfilesystem:Encrypted condition key in an IAM policy. Constraint check: new EFS file systems.
  4. A CloudFront-specific service condition would not express the EFS creation-time encryption requirement. Context cue: systems are encrypted at rest. Which IAM control. Required outcome instead: use the elasticfilesystem:Encrypted condition key in an IAM policy. Constraint check: enforce encryption.

 

Question 20

A company wants both EFS data-at-rest encryption and mandatory encrypted NFS client connections. Which TWO controls address those separate layers? (Choose 2.)

  1. Disable all KMS keys after file-system creation
  2. Enforce TLS for NFS mounts using the EFS mount helper or file-system policy
  3. Use an S3 Bucket Key for EFS
  4. Create the EFS file system with encryption at rest enabled using an appropriate KMS key

Correct Answer(s)

 

B, D

Rationale

  1. Disabling the protecting KMS key can make encrypted data unavailable and is not a method for maintaining confidentiality. Context cue: wants both EFS data-at-rest encryption and mandatory encrypted. Required outcome instead: combine EFS at-rest encryption with mandatory TLS for client NFS traffic. Constraint check: at rest.
  2. TLS on EFS client connections protects NFS traffic in transit, complementing rather than replacing the at-rest encryption layer. Context cue: and mandatory encrypted NFS client connections. Which TWO. Required outcome: combine EFS at-rest encryption with mandatory TLS for client NFS traffic. Constraint check: in transit.
  3. S3 Bucket Keys are an S3 SSE-KMS optimization and do not apply to Amazon EFS file-system encryption. Context cue: encrypted NFS client connections. Which TWO controls address. Required outcome instead: combine EFS at-rest encryption with mandatory TLS for client NFS traffic. Constraint check: in transit.
  4. At-rest encryption is chosen for the EFS file system and can use KMS-backed protection for stored file data. Context cue: A company wants both EFS data-at-rest encryption and. Required outcome: combine EFS at-rest encryption with mandatory TLS for client NFS traffic. Constraint check: at rest.

Related posts:

  1. Amazon AWS AIP-C01 FM Deployment and Endpoints Practice Test 2
  2. Amazon AWS SAA-C03 IAM, Federation, Identity Center, and Least-Privilege Access Practice Test 1
  3. Cisco CCNA 200-301 IPv4 Addressing, Subnetting, and Private Addressing Practice Test 2
  4. Cisco CCNA 200-301 Security Concepts, Programs, and Device Passwords Practice Test 1
  5. Cisco CCNP 350-401 ENCOR 802.1Q Trunking and EtherChannel Troubleshooting Practice Test 3
  6. CompTIA Security+ SY0-701 Cryptography and PKI Practice Test 3
  7. CompTIA Security+ SY0-701 Enterprise Mitigation Techniques Practice Test 1
  8. CompTIA Security+ SY0-701 Enterprise Security Capabilities Practice Test 1
  9. CompTIA Security+ SY0-701 Investigation Data Sources Practice Test 1
  10. Microsoft Azure Administrator AZ-104 Azure Storage Access Practice Test 1

Leave a Reply

Categories

Recent Posts

Recent Comments

    How It Works

    img
    Step 1. Choose Exam
    on ExamLabs
    Download IT Exams Questions & Answers
    img
    Step 2. Open Exam with
    Avanset Exam Simulator
    Press here to download VCE Exam Simulator that simulates real exam environment
    img
    Step 3. Study
    & Pass
    IT Exams Anywhere, Anytime!

    Close