SCS-C03 Data Protection — 10 Questions

Question 1

A security engineer needs to ensure that all objects uploaded to an S3 bucket are encrypted at rest using a customer-managed KMS key. What is the most efficient way to enforce this requirement at the bucket level?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 default encryption for the bucket using the customer-managed key.. While a bucket policy (Option C) can enforce encryption, AWS S3 Default Encryption (Option A) is the native, most efficient, and recommended way to ensure all objects are encrypted at rest. Since the introduction of S3 Bucket Keys and the ability to set default encryption with a KMS key, Option A is the standard configuration. Option C is a valid preventative control, but it is more complex to maintain and prone to errors compared to the native S3 Default Encryption feature.

Answer

Configure an S3 Lifecycle policy to encrypt all objects with the KMS key after upload.

Answer

Attach a bucket policy that denies s3:PutObject if the x-amz-server-side-encryption-aws-kms-key-id header is missing or incorrect.

Answer

Enable S3 Object Lock in compliance mode for all new objects in the bucket.

Question 2

An IAM policy is attached to an application role to allow decryption of S3 objects. However, the application still receives an 'Access Denied' error. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the role permission to use the key.. KMS keys have a unique security model where both the IAM policy and the KMS Key Policy must grant access. Even if the IAM policy is correct, the Key Policy acts as a resource-based policy that must explicitly allow the principal to perform the action. This is a fundamental requirement for KMS, regardless of account boundaries.

Answer

The resource in the IAM policy must be the specific ARN of the KMS key.

Answer

The KMS key is in a different AWS region than the S3 bucket.

Answer

The application is missing the 'kms:GenerateDataKey' permission in its policy.

Question 3

An organization uses AWS Secrets Manager to store database credentials. Which THREE actions are recommended to secure access to these secrets?

Accepted Answer

Use a customer-managed KMS key to encrypt the secrets stored in Secrets Manager.. Using a customer-managed KMS key allows for granular control over encryption/decryption permissions. Automatic rotation limits the lifespan of credentials, reducing the impact of a potential leak. Resource-based policies on the secret provide an additional layer of access control, ensuring that only authorized principals can interact with the secret regardless of their IAM permissions.

Answer

Attach an IAM policy that allows 'secretsmanager:GetSecretValue' to all users.

Answer

Store the secret value in plain text within the application's configuration file.

Question 4

Which AWS feature can be used to monitor and detect accidental exposure of S3 buckets to the public?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty S3 Protection continuously monitors data events and configuration changes to detect risks such as accidental or malicious public exposure of S3 buckets. While AWS Config checks for resource compliance against rules, GuardDuty is specifically designed to detect threats and exposures in real-time.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail

Question 5

A security engineer notices that decryption is failing for an application. Given the provided policy, what is the most likely reason?

Accepted Answer

The application's source IP is not within the defined range.. The stem references a 'provided policy' that is missing from the input. Without the policy, it is impossible to confirm if the 'kms:SourceIp' condition exists or if the other options are valid distractors.

Answer

The KMS key ARN is incorrect for the region.

Answer

The policy is missing the 'kms:GenerateDataKey' permission.

Answer

The 'Effect' should be 'Deny' instead of 'Allow'.

Question 6

A company needs to encrypt data at rest for an Amazon Aurora database. They want to ensure that they maintain full control over the KMS key used for encryption. What is the correct approach?

Accepted Answer

Enable storage encryption during the Aurora cluster creation using a customer-managed key.. Using a customer-managed KMS key (CMK) is the correct way to maintain full control. AWS-managed keys do not allow users to modify the key policy or rotation settings. By creating a CMK, the security team can define the key policy, enabling them to audit access, rotate the key on a specific schedule, and grant cross-account permissions as needed for their data protection requirements.

Answer

Enable encryption using the default AWS-managed key for Aurora.

Answer

Use AWS CloudHSM to manage the encryption keys for the Aurora database.

Answer

Enable TDE (Transparent Data Encryption) in the Aurora parameter group.

Question 7

Which THREE of the following are valid methods for securing data in transit for AWS services?

Accepted Answer

Enforce HTTPS/TLS for all communication to and from AWS services.. Securing data in transit involves ensuring that communications are encrypted using secure protocols like TLS. Using VPC endpoints ensures that traffic between VPC resources and AWS services stays within the AWS network, preventing traversal over the public internet. AWS Site-to-Site VPN provides an encrypted tunnel for traffic between on-premises networks and AWS. Options C and E relate to data at rest and data integrity/retention, not data in transit.

Answer

Store data in an S3 bucket with 'Block Public Access' enabled.

Answer

Enable S3 Object Lock to prevent object deletion.

Question 8

What is the effect of the provided S3 bucket policy?

Accepted Answer

It allows access to the bucket only for HTTPS requests.. The STEM references a 'provided S3 bucket policy' but does not include the JSON policy document. Without the policy, the options cannot be verified.

Answer

It allows only 'ListBucket' actions for all users.

Answer

It forces all users to authenticate using MFA to access the bucket.

Answer

It prevents users from downloading objects unless they have a specific key.

Question 9

A security engineer is tasked with implementing a rotation strategy for a Customer Managed Key (CMK) in AWS KMS that is used to encrypt sensitive financial records. The organization requires that the rotation happens automatically and that historical data remains accessible without manual intervention. Which approach meets these requirements while minimizing operational overhead?

Accepted Answer

Enable automatic key rotation for the CMK, which will generate new key material every year.. AWS KMS now supports configurable automatic key rotation periods (between 90 and 2565 days). The explanation should reflect that the rotation period is configurable, not strictly 365 days.

Answer

Create a new CMK every year and update the application configuration to use the new Key ARN.

Answer

Schedule a Lambda function to perform manual rotation by updating the key alias every 90 days.

Answer

Enable automatic rotation and configure the key to delete old key material after 365 days.

Question 10

Refer to the exhibit. A security engineer has applied the provided bucket policy to an S3 bucket containing sensitive financial data. What is the primary security outcome of this policy configuration?

Accepted Answer

It explicitly denies any request to the bucket that does not use the HTTPS protocol.. The 'aws:SecureTransport' condition key is used to check whether a request was sent using the HTTPS protocol. By using a 'Deny' effect when 'aws:SecureTransport' is false, the policy creates an explicit denial for any unencrypted transit. This is a critical control for protecting data in motion and meeting regulatory requirements.

Answer

It forces all users to use MFA-protected API calls when accessing the bucket.

Answer

It ensures all data stored in the bucket is encrypted using SSE-S3.

Answer

It prevents the bucket from being accessed from any IP address outside of the corporate VPC.