Data protection
Practise only this domain. 69 questions with explanations, 20 at a time.
Start data protectionSample questions
- A company in Account A encrypts its analytics reports with a customer managed KMS key. A data science team in Account B must decrypt those reports, and Account B can already read the bucket that holds them. What must be in place for Account B's decryption calls to succeed?Medium
- An analytics pipeline writes millions of small objects per hour to a bucket encrypted with a customer managed KMS key. KMS request charges and throttling are rising. Which bucket setting cuts the number of KMS requests while keeping the same customer key?Medium
- A healthcare analytics firm keeps research datasets in S3. Its regulator requires that the cloud provider never be able to read plaintext, and the firm must keep the key material in a location it alone controls. Which design satisfies this?Hard
- Amazon Macie reports high-severity sensitive personal data in a production bucket that receives customer uploads. The response must start within minutes, keep a copy of the evidence, and require no manual steps. Which design is best?Medium
- A regulated enterprise with 200 accounts must keep security logs from CloudTrail, Config, VPC flow logs and application logs. The logs must be protected so that no one, including administrators in the workload accounts, can alter or delete them before retention ends. Which design meets this?Hard
- A platform team runs many internal services that authenticate each other with mutual TLS. The certificates should come from the company's own private certificate hierarchy and do not need to be trusted by public browsers. Which AWS service fits?Medium
- Which statement about automatic rotation of a customer managed symmetric KMS key is accurate?Medium
- A team needs to suspend all cryptographic use of a KMS key without destroying it, so it can be restored later if archived data must be read. Which action should they take?Medium
- Which AWS service provides centralized, policy-driven backup across services such as EBS, RDS, DynamoDB, and EFS?Easy
- How does server-side encryption work for Amazon SQS queues?Medium
- Which encryption options are available for Amazon EFS?Easy
- How is data protected when a company uses AWS Storage Gateway?Medium