Exam Bundle

AWS Secrets Manager stores and rotates supported application secrets. This does not address the need for A company wants encryption keys integrated with supported AWS services and fine-grained key policies. The appropriate AWS Key Management Service applies because AWS KMS manages cryptographic keys and their permitted use for supported encryption workflows.

AWS CloudHSM provides dedicated hardware security modules for customer cryptographic key operations. This does not address the need for A company wants encryption keys integrated with supported AWS services and fine-grained key policies. The appropriate AWS Key Management Service applies because AWS KMS manages cryptographic keys and their permitted use for supported encryption workflows.

AWS Certificate Manager manages public or private TLS certificates for supported applications and integrations. This does not address the need for A company wants encryption keys integrated with supported AWS services and fine-grained key policies. The appropriate AWS Key Management Service applies because AWS KMS manages cryptographic keys and their permitted use for supported encryption workflows.

AWS KMS manages encryption keys and related permissions. That does not meet the requirement: A team needs to request and manage TLS certificates for an AWS-integrated HTTPS endpoint.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. That does not meet the requirement: A team needs to request and manage TLS certificates for an AWS-integrated HTTPS endpoint.

AWS Secrets Manager stores and rotates supported application secrets. That does not meet the requirement: A team needs to request and manage TLS certificates for an AWS-integrated HTTPS endpoint.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. This does not address the need for A team needs to request and manage TLS certificates for an AWS-integrated HTTPS endpoint. The appropriate AWS Certificate Manager applies because AWS Certificate Manager manages public or private TLS certificates for supported applications and integrations.

AWS KMS manages encryption keys and related permissions. This does not address the need for A team needs to request and manage TLS certificates for an AWS-integrated HTTPS endpoint. The appropriate AWS Certificate Manager applies because AWS Certificate Manager manages public or private TLS certificates for supported applications and integrations.

AWS Secrets Manager stores and rotates supported application secrets. This does not address the need for A team needs to request and manage TLS certificates for an AWS-integrated HTTPS endpoint. The appropriate AWS Certificate Manager applies because AWS Certificate Manager manages public or private TLS certificates for supported applications and integrations.

AWS Secrets Manager stores and rotates supported application secrets. That does not meet the requirement: Consider this AWS requirement: An application platform wants AWS-managed certificate renewal for supported integrated services.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. That does not meet the requirement: Consider this AWS requirement: An application platform wants AWS-managed certificate renewal for supported integrated services.

AWS KMS manages encryption keys and related permissions. That does not meet the requirement: Consider this AWS requirement: An application platform wants AWS-managed certificate renewal for supported integrated services.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. This does not address the need for An application platform wants AWS-managed certificate renewal for supported integrated services. The appropriate AWS Certificate Manager applies because AWS Certificate Manager manages public or private TLS certificates for supported applications and integrations.

AWS KMS manages encryption keys and related permissions. This does not address the need for An application platform wants AWS-managed certificate renewal for supported integrated services. The appropriate AWS Certificate Manager applies because AWS Certificate Manager manages public or private TLS certificates for supported applications and integrations.

AWS Secrets Manager stores and rotates supported application secrets. This does not address the need for An application platform wants AWS-managed certificate renewal for supported integrated services. The appropriate AWS Certificate Manager applies because AWS Certificate Manager manages public or private TLS certificates for supported applications and integrations.

Unencrypted HTTP: Sends application traffic without transport-layer encryption. That does not meet the requirement: A web app transfers sensitive data between browser and endpoint and must protect the communication channel.

Public bucket access: Makes S3 objects available too broadly unless explicitly constrained by controls. That does not meet the requirement: A web app transfers sensitive data between browser and endpoint and must protect the communication channel.

Encryption at rest only protects stored data but does not by itself encrypt data moving over a network. That does not meet the requirement: A web app transfers sensitive data between browser and endpoint and must protect the communication channel.

Encryption at rest only protects stored data but does not by itself encrypt data moving over a network. This does not address the need for A web app transfers sensitive data between browser and endpoint and must protect the communication channel. The appropriate TLS encryption in transit applies because TLS protects data moving across a network, instead of only securing data stored on media.

Unencrypted HTTP: Sends application traffic without transport-layer encryption. This does not address the need for A web app transfers sensitive data between browser and endpoint and must protect the communication channel. The appropriate TLS encryption in transit applies because TLS protects data moving across a network, instead of only securing data stored on media.

Public bucket access: Makes S3 objects available too broadly unless explicitly constrained by controls. This does not address the need for A web app transfers sensitive data between browser and endpoint and must protect the communication channel. The appropriate TLS encryption in transit applies because TLS protects data moving across a network, instead of only securing data stored on media.

Public bucket access: Makes S3 objects available too broadly unless explicitly constrained by controls. That does not meet the requirement: A technical reviewer evaluates this need: A team must stop network observers from reading data while it is transmitted between systems.

Encryption at rest only protects stored data but does not by itself encrypt data moving over a network. That does not meet the requirement: A technical reviewer evaluates this need: A team must stop network observers from reading data while it is transmitted between systems.

Unencrypted HTTP: Sends application traffic without transport-layer encryption. That does not meet the requirement: A technical reviewer evaluates this need: A team must stop network observers from reading data while it is transmitted between systems.

Encryption at rest only protects stored data but does not by itself encrypt data moving over a network. This does not address the need for A team must stop network observers from reading data while it is transmitted between systems. The appropriate TLS encryption in transit applies because TLS protects data moving across a network, instead of only securing data stored on media.

Public bucket access: Makes S3 objects available too broadly unless explicitly constrained by controls. This does not address the need for A team must stop network observers from reading data while it is transmitted between systems. The appropriate TLS encryption in transit applies because TLS protects data moving across a network, instead of only securing data stored on media.

Unencrypted HTTP: Sends application traffic without transport-layer encryption. This does not address the need for A team must stop network observers from reading data while it is transmitted between systems. The appropriate TLS encryption in transit applies because TLS protects data moving across a network, instead of only securing data stored on media.

Public internet routing: Routes through internet paths rather than using the requested private connectivity. That does not meet the requirement: A company wants stored database records encrypted when data resides on persistent storage.

Transport-only TLS encrypts traffic in transit but does not by itself encrypt stored data. That does not meet the requirement: A company wants stored database records encrypted when data resides on persistent storage.

Open network ACL permits wider subnet traffic rather than implementing the requested least-privilege restriction. That does not meet the requirement: A company wants stored database records encrypted when data resides on persistent storage.

Transport-only TLS encrypts traffic in transit but does not by itself encrypt stored data. This does not address the need for A company wants stored database records encrypted when data resides on persistent storage. The appropriate Encryption at rest applies because Encryption at rest protects persisted data on storage media independently from transit security.

Open network ACL permits wider subnet traffic rather than implementing the requested least-privilege restriction. This does not address the need for A company wants stored database records encrypted when data resides on persistent storage. The appropriate Encryption at rest applies because Encryption at rest protects persisted data on storage media independently from transit security.

Public internet routing: Routes through internet paths rather than using the requested private connectivity. This does not address the need for A company wants stored database records encrypted when data resides on persistent storage. The appropriate Encryption at rest applies because Encryption at rest protects persisted data on storage media independently from transit security.