SCS-C03 Online Practice Questions

Explanation:
The correct answer is D. The AWS Config rules have a MaximumExecutionFrequency value of 24 hours.
According to the AWS documentation1, the MaximumExecutionFrequency parameter specifies the maximum frequency with which AWS Config runs evaluations for a rule.
For AWS Config managed rules, this value can be one of the following:
One_Hour
Three_Hours
Six_Hours
Twelve_Hours
TwentyFour_Hours
If the rule is triggered by configuration changes, it will still run evaluations when AWS Config delivers the configuration snapshot. However, if the rule is triggered periodically, it will not run evaluations more often than the specified frequency.
In this case, the security engineer enabled four AWS Config managed rules that are triggered periodically. Therefore, these rules will only run evaluations every 24 hours, regardless of when the IAM credential report is generated. This means that the resources will display as noncompliant until the next evaluation cycle, which could take up to 24 hours after the IAM access keys are rotated.
The other options are incorrect because:
A) The IAM credential report can be generated at any time, but it will not affect the compliance status of the resources until the next evaluation cycle of the AWS Config rules.
B) The security engineer was able to invoke the IAM GenerateCredentialReport API operation, which means they have the GenerateCredentialReport permission. This permission is required to generate a credential report that lists all IAM users in an AWS account and their credential status2.
C) The security engineer does not need the GetCredentialReport permission to enable or evaluate AWS Config rules. This permission is required to retrieve a credential report that was previously generated by using the GenerateCredentialReport operation2.
Reference: 1: AWS: Config: ConfigRule - AWS CloudFormation
2: IAM: Generate and retrieve IAM credential reports

Explanation:
When implementing DNSSEC for a subdomain in Amazon Route 53 and encountering a broken trust chain error, creating a Delegation Signer (DS) record in the parent hosted zone is the correct approach. The DS record is essential for establishing the trust chain between the parent and child zones by linking the DNSSEC-signed subdomain to its parent domain. This step is crucial for DNS resolvers to validate the authenticity of DNS responses, thereby resolving the broken trust chain issue and ensuring the integrity and authenticity of the DNS data for the secured subdomain.

Explanation:
Client-side encryption involves encrypting data on the client's side (before it is transferred across the network) and then sending the encrypted data to S3. This ensures that the data is encrypted before it's transmitted over the network to the S3 bucket. This is the method that ensures that data is encrypted "before sending it across the wire", as the question specifies.
Here is why the other options are not the best choices:
A. Server-side encryption (SSE) encrypts the data at rest once it reaches the S3 bucket. Although the data is encrypted during transmission, it's not encrypted by the client before sending it across the network.
B. IAM does not have an "Encryption CLI." AWS CLI can be used to interact with AWS services, including S3, and client-side encryption libraries can be used to encrypt data before uploading it using the AWS CLI, but IAM primarily manages access and permissions, not encryption tasks.
C. Using a Lambda function to encrypt the data before sending it to S3 could be a valid approach, but it would be more complex than necessary compared to directly enabling client encryption. Lambda would be used more for automated data processing tasks or similar, not generally as a primary means of encrypting data before transmission. It's a viable option but not the best or simplest method compared to client-side encryption.

Explanation:
To meet the requirements of storing scanned copies of customer receipts on Amazon S3, where files will be between 100 KB and 5 MB in PDF format, each retail store must have a unique encryption key, and each object must be encrypted with a unique key, the most appropriate solution would be to create a dedicated AWS Key Management Service (AWS KMS) customer managed key for each retail store. Then, use the S3 Put operation to upload the objects to Amazon S3, specifying server-side encryption with AWS KMS keys (SSE-KMS) and the key ID of the store’s key.
References: : Amazon S3 - Amazon Web Services : AWS Key Management Service - Amazon Web
Services : Amazon S3 - Amazon Web Services : AWS Key Management Service - Amazon Web Services