Design and implement controls to protect credentials, secrets, and cryptographic key materials.
18 practice questions under this official exam objective (SCS-C02, SCS-C03), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
18 total · page 1 of 1Replicate Secrets Manager secrets across Regions with a multi-Region customer managed KMS
A company must replicate Secrets Manager secrets from us-east-1 to us-west-1, encrypted with KMS, working even if one Region is down and with low late
How Should You Handle Leaked IAM Access Keys?
Exposed IAM access keys in a public repository require immediate containment and usage review. The correct SCS-C03 response is to deactivate the key a
Add an S3 gateway endpoint and a KMS interface endpoint with private DNS in Account B's VP
Account B's EC2 fleet reads/writes an Account A S3 bucket (KMS-encrypted) and must make no AWS API calls over the internet, with no code change. Creat
Restore a deleted imported key material by reimporting the same material to decrypt the EB
An EBS volume is encrypted with a customer managed KMS key whose imported key material was deleted, making the key unusable and blocking attachment. B
Rotate a KMS key with imported material by creating a new key, importing new material, and
A customer managed KMS key uses imported key material, and policy requires annual rotation. AWS KMS does not support automatic key rotation for keys w
Replicate Secrets Manager secrets across Regions with a multi-Region customer managed KMS
A company must replicate Secrets Manager secrets from us-east-1 to us-west-1, encrypted with KMS, working even if one Region is down and with low late
Fix encrypted-S3 AccessDenied by attaching an inline kms:Decrypt policy to the instance ro
An EC2 instance profile uses the AWS managed ReadOnlyAccess policy and gets AccessDenied reading a file from an encrypted S3 bucket, even though the b
How Should Secrets Manager Secrets Be Encrypted and Replicated to us-west-1?
Secrets Manager multi-Region replication with KMS encryption is the focus; this page establishes that replicating the secret and using a destination-R
Restore S3 GetObject access by fixing ListBucket, KMS Decrypt, and the gateway-endpoint bu
An EC2 app reaches S3 only through a gateway VPC endpoint, and objects are KMS-CMK encrypted. Three things can block GetObject: the instance profile l
Encrypt EBS by default with an instance refresh and build an encrypted Aurora cluster from
Web and backend EC2 layers use EBS that is unencrypted, and an Aurora MySQL cluster is unencrypted. For EBS, enable EBS encryption-by-default in the R
Eliminate post-CreateGrant AccessDenied errors by passing the returned grant token to encr
A grant created with CreateGrant may not be effective immediately because KMS is eventually consistent, causing intermittent AccessDeniedException on
Encrypt the 2 KB file directly with the aws kms encrypt command
A cron job encrypts a small 2 KB file using a configured KMS customer managed key. The AWS KMS Encrypt API accepts plaintext up to 4,096 bytes, so a 2
Use a KMS key alias and create a new customer managed key on each change
With an AWS-owned key the company cannot control key material; to allow on-demand key changes, create a customer managed key (CMK) and reference it th
How to Create CloudHSM-Backed KMS Keys and Audit Their Use?
Creating and controlling keys in AWS KMS custom key stores backed by AWS CloudHSM keeps symmetric key material inside the HSM cluster, and AWS CloudTr
Store the SaaS client token as a Parameter Store SecureString and retrieve it in Lambda
To encrypt a SaaS client token at rest and pass it to a Lambda at runtime most cost-effectively, store it as a SecureString parameter in AWS Systems M
Use KMS with imported key material and DeleteImportedKeyMaterial for immediate key removal
The team needs transparent S3 encryption at scale with no ongoing key management, plus the ability to instantly delete the key material. KMS with impo
Add an interface VPC endpoint for Secrets Manager
In a VPC with no internet, a Secrets Manager rotation Lambda in the VPC cannot reach the Secrets Manager endpoint. The most secure fix is an interface
How to Recover an EBS Volume After KMS Key Material Deletion?
When imported KMS key material is deleted, the customer managed key becomes unusable and EBS volumes encrypted under it cannot be attached. This page