Design and implement controls that provide confidentiality and integrity for data in transit.
15 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
15 total · page 1 of 1Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP
Before an audit, the company must find PHI in S3, find publicly accessible buckets, and collect compliance evidence with least overhead. Amazon Macie
Restore a deleted imported key material by reimporting the same material to decrypt the EB
An EBS volume is encrypted with a customer managed KMS key whose imported key material was deleted, making the key unusable and blocking attachment. B
Protect HLS CloudFront streams with signed cookies instead of per-chunk signed URLs
An HLS live stream served through CloudFront is split into thousands of chunks, and only authenticated subscribers should fetch them. Because a single
Write to a cross-account S3 bucket privately using a gateway VPC endpoint
An app in Account A's VPC must write to an S3 bucket in Account B in the same Region without using the public internet. The bucket policy already gran
How Should Secrets Manager Secrets Be Encrypted and Replicated to us-west-1?
Secrets Manager multi-Region replication with KMS encryption is the focus; this page establishes that replicating the secret and using a destination-R
Encrypt EBS by default with an instance refresh and build an encrypted Aurora cluster from
Web and backend EC2 layers use EBS that is unencrypted, and an Aurora MySQL cluster is unencrypted. For EBS, enable EBS encryption-by-default in the R
Encrypt the 2 KB file directly with the aws kms encrypt command
A cron job encrypts a small 2 KB file using a configured KMS customer managed key. The AWS KMS Encrypt API accepts plaintext up to 4,096 bytes, so a 2
Scope the CMK key policy to S3/DynamoDB/Lambda/EKS and deny unencrypted S3/DynamoDB via SC
To encrypt all data at rest (S3, DynamoDB, Lambda, EKS) and enforce least privilege, create a CMK whose key policy allows kms:Decrypt only for those s
How to Create CloudHSM-Backed KMS Keys and Audit Their Use?
Creating and controlling keys in AWS KMS custom key stores backed by AWS CloudHSM keeps symmetric key material inside the HSM cluster, and AWS CloudTr
Request an ACM certificate, validate via DNS CNAMEs, and attach it to a CloudFront distrib
For managed distribution/caching with auto-renewing public certs on non-Route 53 domains, request an ACM certificate (for CloudFront it must be in us-
Abort the Glacier vault lock, fix the policy, and initiate the lock again
A Glacier Vault Lock was initiated 12 hours ago but has a typo allowing unintended access. Vault Lock has a lock-in waiting period before the policy b
Deploy the tokenization code on AWS Nitro Enclaves for an isolated, attestable environment
Credit-card tokenization must run in an isolated environment that other application components cannot reach, handling encryption, storage, decryption,
Apply an inbound SNS message data protection policy with the De-identify operation to mask
To stop sensitive data in SNS messages from leaking into transaction/debug logs, configure an inbound message data protection policy on the SNS topics
Use an ALB HTTPS listener security policy with a PFS cipher suite
TLS terminates at an ALB and must remain secure even if the certificate's private key is compromised. A listener security policy that enforces a Perfe
How to Recover an EBS Volume After KMS Key Material Deletion?
When imported KMS key material is deleted, the customer managed key becomes unusable and EBS volumes encrypted under it cannot be attached. This page