Amazon Exam SCS-C02 Topic 2 Question 16 Discussion

Actual exam question for Amazon's SCS-C02 exam

Question #: 16
Topic #: 2

A company stores sensitive documents in Amazon S3 by using server-side encryption with an IAM Key Management Service (IAM KMS) CMK. A new requirement mandates that the CMK that is used for these documents can be used only for S3 actions.

Which statement should the company add to the key policy to meet this requirement?

AOption A

BOption B

Show Suggested Answer

Suggested Answer: D

To ensure minimal latency and regional availability of secrets, encrypting secrets in us-east-1 with a customer-managed KMS key and then replicating them to us-west-1 for encryption with the same key is the optimal approach. This method leverages customer-managed KMS keys for enhanced control and ensures that secrets are available in both regions, adhering to disaster recovery principles and minimizing latency by using regional endpoints.

by Lindsay at Apr 24, 2024, 12:33 PM

Limited Time Offer

25%

Off

Get Premium SCS-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Derick

1 days ago

Option B? More like Option 'Bingo!' Am I right, folks? *crickets* Tough crowd.

upvoted 0 times

...

Casey

3 days ago

Option B all the way! Though I have to say, the exam writers really love tripping us up with these seemingly straightforward questions. Can't let my guard down for a second!

upvoted 0 times

...

Sarina

9 days ago

Hold up, are we sure the key policy is the right place to add this restriction? Shouldn't we be looking at the IAM policy instead? Hmm, maybe I need to brush up on my AWS security knowledge.

upvoted 0 times

...

Ashlee

17 days ago

Option A looks like it's trying to restrict the CMK to only a specific IAM user, which doesn't align with the requirement. Option B seems more on point.

upvoted 0 times

...