1.3 Determine appropriate data security controls.
Objective 1.3 sits in Design Secure Architectures, which carries 30% of the Solutions Architect Associate exam. The questions below are original, written from the official objective title above, and each explanation cites the AWS page it rests on.
Objective title verbatim from the official objectives. AWS exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
An auditor asks how objects in a new bucket are protected at rest. Nobody on the team configured encryption there. What is in force?
The concept
A protection that somebody has to switch on protects nobody. Object storage now applies a baseline as it writes, so the open question is which key material is used, never whether anything happened at all.
Why this answer
Every bucket carries a base level configuration and each new upload is written encrypted at no extra cost. A team that wants different key material changes the bucket default or names a type per request.
- AThat held before the base level reached every bucket. There is nothing left to turn on for new uploads.
- Correct. New uploads are covered by keys the service holds, with no action from the bucket owner.
- CThat type is available and is what you pick when you want a key policy of your own and a usage trail. It is not the baseline.
- DTLS covers the wire. What happens on disk is decided by the bucket configuration rather than by the transport the client used.
Now you: objective 1.3 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
Compliance requires a team to control who may decrypt a bucket's objects and to see each key use in CloudTrail. Which encryption option fits?
Sample question 2 of 3
A production RDS instance runs unencrypted, and compliance now requires encryption at rest. Which sequence gets your team there?
Sample question 3 of 3
An engineer disables the KMS key behind an encrypted RDS instance that has backups turned on. What happens to the instance?
Full Solutions Architect Associate question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.