Amazon Exam SCS-C01 Topic 3 Question 58 Discussion

Actual exam question for Amazon's SCS-C01 exam

Question #: 58
Topic #: 3

Your company hosts critical data in an S3 bucket. There is a requirement to ensure that all data is encrypted. There is also metadata about the information stored in the bucket that needs to be encrypted as well. Which of the below measures would you take to ensure that the metadata is encrypted?

Please select:

APut the metadata as metadata for each object in the S3 bucket and then enable S3 Server side encryption.

BPut the metadata as metadata for each object in the S3 bucket and then enable S3 Server KMS encryption.

CPut the metadata in a DynamoDB table and ensure the table is encrypted during creation time.

DPut thp metadata in thp S3 hurkpf itself.

Show Suggested Answer

Suggested Answer: D

To configure DNSSEC for a domain registered with Route 53, the most operationally efficient solution is to migrate the zone to Route 53 with DNSSEC signing enabled, create a key-signing key (KSK) that is based on an AWS Key Management Service (AWS KMS) customer managed key, and add a delegation signer (DS) record to the parent zone. This way, Route 53 handles the zone-signing key (ZSK) and the signing of the records in the hosted zone, and the customer only needs to manage the KSK in AWS KMS and provide the DS record to the domain registrar. Option A is incorrect because it does not involve migrating the zone to Route 53, which would simplify the DNSSEC configuration. Option B is incorrect because it creates both a ZSK and a KSK based on AWS KMS customer managed keys, which is unnecessary and less efficient than letting Route 53 manage the ZSK. Option C is incorrect because it does not involve migrating the zone to Route 53, and it requires running the dnssec-signzone command manually, which is less efficient than letting Route 53 sign the zone automatically. Verified Reference:

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/domain-configure-dnssec.html

https://aws.amazon.com/about-aws/whats-new/2020/12/announcing-amazon-route-53-support-dnssec/

by Norah at Apr 19, 2024, 08:29 AM

Limited Time Offer

25%

That sounds like a good option.

upvoted 0 times

...

Salena

1 years ago

B) Migrate the zone to Route 53 with DNSSEC signing enabled. Create a zone-signing key (ZSK) and a key-signing key (KSK) that are based on an AWS Key Management Service (AWS KMS) customer managed key.

upvoted 0 times

...