Encryption, KMS, ACM and Macie: DOP-C02 study notes and practice questions
What to know about Encryption, KMS, ACM and Macie for the DOP-C02 exam, from the Security and Compliance domain (17% of the exam guide), then 2 free questions to test it. Part of the DOP-C02 study guide.
These questions ask which encryption setting meets a rule, or how to find sensitive data across accounts.
AWS KMS
Customer managed keys give full control: key policies, grants, rotation, and cross-account use. AWS managed keys can’t be shared across accounts.
The key policy is the primary control; IAM policies only work when the key policy allows them.
Automatic rotation (configurable period) keeps old key material for decryption.
Multi-Region keys encrypt in one Region and decrypt in another (DR, global tables).
Encryption context and kms:ViaService conditions narrow how a key can be used.
Deleting a key has a waiting period (7 to 30 days); disable first to test impact.
Encrypting at rest
EBS encryption by default per Region; encrypted snapshots and AMIs need key access to share.
S3: SSE-S3 by default; SSE-KMS with Bucket Keys for audit and control; enforce with bucket policies and default encryption.
RDS, DynamoDB, EFS, CloudWatch Logs, SNS, SQS and Secrets Manager all accept customer managed keys.
In transit
ACM issues public certificates for ELB, CloudFront and API Gateway. DNS validation renews automatically while the CNAME record stays in place; email validation needs someone to respond.
AWS Private CA for internal certificates.
Enforce TLS with aws:SecureTransport in bucket policies and TLS-only listeners.
Discovering sensitive data
Amazon Macieautomated sensitive data discovery, run from the organization’s Macie administrator account, continually samples objects across member buckets and reports where PII lives, with findings in EventBridge and Security Hub CSPM.
Common traps
AWS managed keys for cross-account sharing.
Email-validated certificates that fail to renew.
Scripts that scan buckets for PII when Macie does it.
An insurance firm stores claim attachments in about 200 Amazon S3 buckets across its member accounts. Some attachments were uploaded with scanned identity documents and medical notes, but nobody has an inventory of which buckets hold this sensitive data.
The privacy office wants every bucket checked for sensitive data, including buckets created later, with results visible to a central security account. The scanning must not require the firm to build and run its own scanning system.
Which approach meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Enable Macie automated sensitive data discovery from the organization's Macie administrator account, so that buckets in every member account, including new ones, are sampled.
BB. Write a Lambda function that lists every bucket each night, downloads a sample of objects, and searches them for patterns with a regular expression that the team maintains.
CC. Turn on S3 server access logging for all buckets, and review the access logs to see which buckets are used most often, so that the privacy office can choose which buckets to check.
DD. Enable default encryption with an AWS KMS key on every bucket, which means sensitive data is encrypted and the privacy office no longer needs to find it.
Show the answer and explanation
Answer: A
A. Right: Correct. Automated sensitive data discovery continually evaluates the bucket inventory, including buckets that member accounts own, and samples objects for sensitive data. The Macie administrator sees the results centrally without a custom scanner. Learn more: Performing automated sensitive data discovery (opens in a new tab)
B. Wrong: The team would build and run a scanner, keep its patterns current and handle its own errors and costs. The requirement was to avoid running its own scanning system.
C. Wrong: Access logs show who requested objects, not what the objects contain. They do not identify sensitive data in the buckets.
Amazon Macie automated sensitive data discovery, managed from the organization's Macie administrator account, continually evaluates the bucket inventory and samples objects in member buckets, including buckets created later. The results are central, and no scanner needs to be built. Custom scanners, access logs and encryption each miss either the inventory or the managed-service requirement.
A university's student portal runs behind an Application Load Balancer, with its DNS name managed in Amazon Route 53 in the same account. The portal needs a public TLS certificate from AWS Certificate Manager for its domain, and browsers on student devices must trust it without any extra setup.
The certificate must renew automatically, so that no one has to track expiry dates as certificate lifetimes get shorter, and the request should not depend on an email message to a mailbox that may be unmonitored.
Which approach meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Request the certificate with email validation, sent to the domain's administrative contact address, and request a new certificate by hand each time the current one nears expiry.
BB. Generate a certificate with OpenSSL on an administrator's workstation, import it into ACM, and set a calendar reminder to import a new certificate before the old one expires.
CC. Create a self-signed certificate for the portal, and install it on the load balancer with a longer validity period, so that renewal is needed only every several years.
DD. Request the public certificate from ACM with DNS validation, and create the validation CNAME record in the Route 53 hosted zone, so that ACM renews the certificate automatically while the record remains.
ACM certificates validated by DNS can renew automatically while the validation CNAME record remains in the Route 53 hosted zone, and no mailbox is needed. Email validation depends on a mailbox, imported certificates need manual replacement, and self-signed certificates are not trusted by browsers.
Want more on Encryption, KMS, ACM and Macie? The 5 full-length practice sets have 10 more Encryption, KMS, ACM and Macie questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →