Scenario practice questions

Refer to the exhibit. A company has an S3 bucket with server-side encryption using AWS KMS. The bucket policy allows access to a user, but the user receives 'Access Denied' when trying to download an object. The IAM policy for the user is shown. What is the MOST likely cause?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:us-east-1:123456789012:key/abc123",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "s3.amazonaws.com"
        }
      }
    }
  ]
}

Trap 1: The user does not have MFA enabled.

MFA is not required by this policy.

Trap 2: The KMS key ID in the policy is incorrect.

The key ID appears correct.

Trap 3: The policy does not allow kms:Decrypt for the S3 bucket.

The policy allows Decrypt for S3.

A
The user does not have MFA enabled.
Why wrong: MFA is not required by this policy.
B
The KMS key ID in the policy is incorrect.
Why wrong: The key ID appears correct.
C
The policy does not allow kms:Decrypt for the S3 bucket.
Why wrong: The policy allows Decrypt for S3.
D
The policy has a condition that limits kms:Decrypt to when the request is made through the S3 service, but the user might be using a different service to access the object (e.g., directly via KMS API).
The condition 'kms:ViaService' ensures decryption only through S3.

Question 2easymultiple choice

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest. Which action should the company take to enable encryption on the RDS instance?

Trap 1: Modify the existing RDS DB instance and enable encryption.

You cannot enable encryption on an existing unencrypted RDS instance.

Trap 2: Enable Oracle Transparent Data Encryption (TDE) on the existing RDS…

While TDE is supported on RDS Oracle, you need to use an option group and it can be enabled on existing instances, but the question asks for encryption at rest which is also achievable via KMS; however, TDE is an additional cost and the simplest answer is to create a new encrypted instance.

Trap 3: Take a snapshot of the existing database, encrypt the snapshot, and…

You cannot encrypt a snapshot of an unencrypted instance.

A
Modify the existing RDS DB instance and enable encryption.
Why wrong: You cannot enable encryption on an existing unencrypted RDS instance.
B
Create a new RDS DB instance with encryption enabled and migrate the data.
Encryption can only be enabled at creation time.
C
Enable Oracle Transparent Data Encryption (TDE) on the existing RDS instance.
Why wrong: While TDE is supported on RDS Oracle, you need to use an option group and it can be enabled on existing instances, but the question asks for encryption at rest which is also achievable via KMS; however, TDE is an additional cost and the simplest answer is to create a new encrypted instance.
D
Take a snapshot of the existing database, encrypt the snapshot, and restore from it.
Why wrong: You cannot encrypt a snapshot of an unencrypted instance.

Question 3mediummulti select

A company is deploying a new MySQL database on Amazon RDS. The database must be highly available and support cross-Region disaster recovery. Which TWO actions should be taken? (Choose two.)

Trap 1: Enable encryption at rest using AWS KMS.

Encryption is for security, not HA or DR.

Trap 2: Deploy a Multi-AZ instance in multiple regions.

RDS does not support Multi-Region Multi-AZ.

Trap 3: Enable automated backups with a retention period of 35 days.

Backups are for recovery, not cross-region DR.

A
Enable encryption at rest using AWS KMS.
Why wrong: Encryption is for security, not HA or DR.
B
Deploy a Multi-AZ instance in multiple regions.
Why wrong: RDS does not support Multi-Region Multi-AZ.
C
Enable automated backups with a retention period of 35 days.
Why wrong: Backups are for recovery, not cross-region DR.
D
Create a cross-region read replica.
Provides disaster recovery in another region.
E
Enable Multi-AZ for automatic failover within a region.
Provides high availability within a region.

Question 4easymultiple choice

A startup is running an Amazon RDS for PostgreSQL database for its web application. The database size is 50 GB. The company wants to implement a backup strategy that allows point-in-time recovery (PITR) to any point within the last 35 days with minimal storage cost. Which backup strategy should be used?

Trap 1: Use AWS Backup to schedule daily snapshots with 35-day retention.

AWS Backup snapshots do not support PITR.

Trap 2: Enable automated backups with 7-day retention and copy snapshots to…

Cross-region copy adds cost and does not extend PITR.

Trap 3: Take manual snapshots daily and retain 35 snapshots.

Manual snapshots do not support PITR.

A
Enable automated backups with a retention period of 35 days.
Automated backups support PITR up to 35 days.
B
Use AWS Backup to schedule daily snapshots with 35-day retention.
Why wrong: AWS Backup snapshots do not support PITR.
C
Enable automated backups with 7-day retention and copy snapshots to another region.
Why wrong: Cross-region copy adds cost and does not extend PITR.
D
Take manual snapshots daily and retain 35 snapshots.
Why wrong: Manual snapshots do not support PITR.

Question 5hardmultiple choice

A company runs a critical application on an Amazon RDS for MySQL DB instance. The company requires that the database be available with minimal downtime during a disaster recovery scenario. The current RDS instance is in us-east-1. The company wants to have a standby database in us-west-2 with automatic failover. What should the company do to meet this requirement?

Trap 1: Create a Multi-AZ deployment in us-west-2 and use Amazon Route 53…

The primary database is in us-east-1, so a Multi-AZ in us-west-2 does not help.

Trap 2: Take daily snapshots and copy them to us-west-2

This approach has significant downtime for snapshot restoration.

Trap 3: Create a Multi-AZ deployment in us-east-1.

Multi-AZ provides high availability within a single region, not cross-region disaster recovery.

A
Create a Multi-AZ deployment in us-west-2 and use Amazon Route 53 to failover.
Why wrong: The primary database is in us-east-1, so a Multi-AZ in us-west-2 does not help.
B
Take daily snapshots and copy them to us-west-2. Restore from snapshot in us-west-2 during a disaster.
Why wrong: This approach has significant downtime for snapshot restoration.
C
Create a cross-region read replica in us-west-2. Configure automatic failover using Amazon Route 53 health checks.
The read replica can be promoted quickly, and Route 53 can redirect traffic automatically.
D
Create a Multi-AZ deployment in us-east-1.
Why wrong: Multi-AZ provides high availability within a single region, not cross-region disaster recovery.