Security and Compliance

1. A company stores sensitive customer records in Amazon S3 and wants AWS to manage the encryption keys automatically without any additional configuration. Which S3 encryption option best meets this requirement?

• A.SSE-S3, where Amazon S3 manages encryption keys entirely on your behalf using AES-256.✓ Correct
• B.SSE-KMS, where AWS Key Management Service manages a customer master key for encryption.
• C.Client-side encryption, where the application encrypts data before uploading it to S3.
• D.SSE-C, where the customer provides their own encryption keys with each API request.

2. A financial firm requires full audit trails for every encryption key usage event in Amazon S3, including who accessed a key and when. Which encryption method provides this level of key activity logging?

• A.SSE-S3, which encrypts objects automatically.
• B.SSE-KMS, which integrates with AWS CloudTrail to log every use of the customer master key.✓ Correct
• C.Client-side encryption using an on-premises HSM outside of AWS logging infrastructure.
• D.Amazon S3 server access logging, which records HTTP requests.

3. An application transmits personally identifiable information (PII) between a web browser and an Amazon EC2-hosted API. Which AWS-recommended mechanism protects this data while it travels over the network?

• A.Enabling Amazon S3 server-side encryption to protect data stored in transit buckets.
• B.Using AWS Shield Standard to absorb DDoS traffic before it reaches the application.
• C.Enforcing HTTPS using SSL/TLS certificates so data is encrypted during network transmission.✓ Correct
• D.Placing the EC2 instance inside a private subnet to restrict inbound internet traffic.

4. A developer needs to create and control the lifecycle of cryptographic keys used to encrypt data across multiple AWS services. Which AWS service is designed specifically for this purpose?

• A.AWS Certificate Manager, which provisions and manages SSL/TLS certificates for web endpoints.
• B.AWS Key Management Service (KMS), which creates and controls customer master keys for encryption.✓ Correct
• C.AWS Secrets Manager, which stores and rotates database credentials and API keys securely.
• D.AWS CloudHSM, which provides dedicated single-tenant hardware security modules for key storage.

5. A security team wants to use their own cryptographic key material imported into AWS KMS rather than having AWS generate the key. What does AWS KMS support to enable this?

• A.Customer-managed CMKs with imported key material, allowing the customer to supply their own key bytes.✓ Correct
• B.AWS-managed CMKs, which are automatically created and rotated entirely by AWS without import options.
• C.AWS CloudTrail key pairs, which store externally generated keys inside CloudTrail log groups.
• D.IAM access keys, which authenticate API calls and can double as encryption key material in KMS.