SCS-C03 Data Protection — 25 Questions

Question 1

A security engineer needs to ensure that all objects uploaded to an S3 bucket are encrypted at rest using a customer-managed KMS key. What is the most efficient way to enforce this requirement at the bucket level?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 default encryption for the bucket using the customer-managed key.. While a bucket policy (Option C) can enforce encryption, AWS S3 Default Encryption (Option A) is the native, most efficient, and recommended way to ensure all objects are encrypted at rest. Since the introduction of S3 Bucket Keys and the ability to set default encryption with a KMS key, Option A is the standard configuration. Option C is a valid preventative control, but it is more complex to maintain and prone to errors compared to the native S3 Default Encryption feature.

Answer

Configure an S3 Lifecycle policy to encrypt all objects with the KMS key after upload.

Answer

Attach a bucket policy that denies s3:PutObject if the x-amz-server-side-encryption-aws-kms-key-id header is missing or incorrect.

Answer

Enable S3 Object Lock in compliance mode for all new objects in the bucket.

Question 2

An IAM policy is attached to an application role to allow decryption of S3 objects. However, the application still receives an 'Access Denied' error. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the role permission to use the key.. KMS keys have a unique security model where both the IAM policy and the KMS Key Policy must grant access. Even if the IAM policy is correct, the Key Policy acts as a resource-based policy that must explicitly allow the principal to perform the action. This is a fundamental requirement for KMS, regardless of account boundaries.

Answer

The resource in the IAM policy must be the specific ARN of the KMS key.

Answer

The KMS key is in a different AWS region than the S3 bucket.

Answer

The application is missing the 'kms:GenerateDataKey' permission in its policy.

Question 3

An organization uses AWS Secrets Manager to store database credentials. Which THREE actions are recommended to secure access to these secrets?

Accepted Answer

Use a customer-managed KMS key to encrypt the secrets stored in Secrets Manager.. Using a customer-managed KMS key allows for granular control over encryption/decryption permissions. Automatic rotation limits the lifespan of credentials, reducing the impact of a potential leak. Resource-based policies on the secret provide an additional layer of access control, ensuring that only authorized principals can interact with the secret regardless of their IAM permissions.

Answer

Attach an IAM policy that allows 'secretsmanager:GetSecretValue' to all users.

Answer

Store the secret value in plain text within the application's configuration file.

Question 4

Which AWS feature can be used to monitor and detect accidental exposure of S3 buckets to the public?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty S3 Protection continuously monitors data events and configuration changes to detect risks such as accidental or malicious public exposure of S3 buckets. While AWS Config checks for resource compliance against rules, GuardDuty is specifically designed to detect threats and exposures in real-time.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS CloudTrail

Question 5

A security engineer notices that decryption is failing for an application. Given the provided policy, what is the most likely reason?

Accepted Answer

The application's source IP is not within the defined range.. The stem references a 'provided policy' that is missing from the input. Without the policy, it is impossible to confirm if the 'kms:SourceIp' condition exists or if the other options are valid distractors.

Answer

The KMS key ARN is incorrect for the region.

Answer

The policy is missing the 'kms:GenerateDataKey' permission.

Answer

The 'Effect' should be 'Deny' instead of 'Allow'.

Question 6

A company needs to encrypt data at rest for an Amazon Aurora database. They want to ensure that they maintain full control over the KMS key used for encryption. What is the correct approach?

Accepted Answer

Enable storage encryption during the Aurora cluster creation using a customer-managed key.. Using a customer-managed KMS key (CMK) is the correct way to maintain full control. AWS-managed keys do not allow users to modify the key policy or rotation settings. By creating a CMK, the security team can define the key policy, enabling them to audit access, rotate the key on a specific schedule, and grant cross-account permissions as needed for their data protection requirements.

Answer

Enable encryption using the default AWS-managed key for Aurora.

Answer

Use AWS CloudHSM to manage the encryption keys for the Aurora database.

Answer

Enable TDE (Transparent Data Encryption) in the Aurora parameter group.

Question 7

Which THREE of the following are valid methods for securing data in transit for AWS services?

Accepted Answer

Enforce HTTPS/TLS for all communication to and from AWS services.. Securing data in transit involves ensuring that communications are encrypted using secure protocols like TLS. Using VPC endpoints ensures that traffic between VPC resources and AWS services stays within the AWS network, preventing traversal over the public internet. AWS Site-to-Site VPN provides an encrypted tunnel for traffic between on-premises networks and AWS. Options C and E relate to data at rest and data integrity/retention, not data in transit.

Answer

Store data in an S3 bucket with 'Block Public Access' enabled.

Answer

Enable S3 Object Lock to prevent object deletion.

Question 8

What is the effect of the provided S3 bucket policy?

Accepted Answer

It allows access to the bucket only for HTTPS requests.. The STEM references a 'provided S3 bucket policy' but does not include the JSON policy document. Without the policy, the options cannot be verified.

Answer

It allows only 'ListBucket' actions for all users.

Answer

It forces all users to authenticate using MFA to access the bucket.

Answer

It prevents users from downloading objects unless they have a specific key.

Question 9

A security engineer is tasked with implementing a rotation strategy for a Customer Managed Key (CMK) in AWS KMS that is used to encrypt sensitive financial records. The organization requires that the rotation happens automatically and that historical data remains accessible without manual intervention. Which approach meets these requirements while minimizing operational overhead?

Accepted Answer

Enable automatic key rotation for the CMK, which will generate new key material every year.. AWS KMS now supports configurable automatic key rotation periods (between 90 and 2565 days). The explanation should reflect that the rotation period is configurable, not strictly 365 days.

Answer

Create a new CMK every year and update the application configuration to use the new Key ARN.

Answer

Schedule a Lambda function to perform manual rotation by updating the key alias every 90 days.

Answer

Enable automatic rotation and configure the key to delete old key material after 365 days.

Question 10

Refer to the exhibit. A security engineer has applied the provided bucket policy to an S3 bucket containing sensitive financial data. What is the primary security outcome of this policy configuration?

Accepted Answer

It explicitly denies any request to the bucket that does not use the HTTPS protocol.. The 'aws:SecureTransport' condition key is used to check whether a request was sent using the HTTPS protocol. By using a 'Deny' effect when 'aws:SecureTransport' is false, the policy creates an explicit denial for any unencrypted transit. This is a critical control for protecting data in motion and meeting regulatory requirements.

Answer

It forces all users to use MFA-protected API calls when accessing the bucket.

Answer

It ensures all data stored in the bucket is encrypted using SSE-S3.

Answer

It prevents the bucket from being accessed from any IP address outside of the corporate VPC.

Question 11

Refer to the exhibit. This policy is attached to a KMS Customer Managed Key (CMK) in Account 111122223333. What is the effect of the 'root' principal being granted 'kms:*' permissions in this key policy?

Accepted Answer

It allows the account's IAM policies to further define and grant permissions to the key.. Granting 'kms:*' to the root principal in a key policy delegates the ability to manage the key to the account's IAM policies. Without this delegation, even an IAM administrator with full permissions would be unable to manage or use the key if the key policy does not explicitly grant them access. The root principal acts as a bridge, allowing IAM policies to govern access.

Answer

It restricts all KMS operations to only be performed by the account's root user.

Answer

It automatically grants every IAM user in the account full access to the KMS key.

Answer

It makes the KMS key public and allows any AWS account to use it for encryption.

Question 12

A company wants to migrate an unencrypted Amazon Redshift cluster to an encrypted cluster using a KMS Customer Managed Key (CMK). The data must be protected during and after the migration. Which TWO steps are necessary to complete this process?

Accepted Answer

Create a manual snapshot of the existing unencrypted Redshift cluster.. Amazon Redshift does not support enabling encryption on an existing cluster. The standard migration path is to take a manual snapshot of the unencrypted cluster, then restore that snapshot into a new cluster while selecting the desired KMS key for encryption during the restoration process.

Answer

Use the 'Modify Cluster' command to enable encryption on the live Redshift cluster.

Answer

Enable 'Encryption by Default' in the Redshift console to automatically migrate the data.

Answer

Attach a KMS key policy to the unencrypted cluster to encrypt the data in place.

Question 13

An organization needs to store compliance records in Amazon S3. The records must not be deleted or overwritten by any user, including the root user, for a period of five years. Which S3 feature provides this level of data protection?

Accepted Answer

S3 Object Lock in Compliance mode.. S3 Object Lock provides a 'Write Once Read Many' (WORM) model. In 'Compliance mode', an object version cannot be overwritten or deleted by any user, including the root user in your AWS account. This is the strongest form of protection for data that must be preserved for regulatory or legal reasons.

Answer

S3 Object Lock in Governance mode.

Answer

S3 Bucket Policies with an explicit Deny for 's3:DeleteObject'.

Answer

Amazon S3 Glacier with a Vault Lock policy.

Question 14

A company wants to centralize the management of backups for Amazon EBS volumes, RDS databases, and EFS file systems across multiple AWS regions. They need to ensure that backups are encrypted and can be restored in a different region. Which TWO steps should be taken?

Accepted Answer

Use AWS Backup to create a central backup plan and enable cross-region copy.. AWS Backup cross-region copy requires that the destination vault be encrypted with a KMS key in the destination region. If the source is encrypted with a CMK, the destination must also use a CMK in the destination region to re-encrypt the copy, as KMS keys are region-specific.

Answer

Enable EBS Multi-Region Replication for all volumes needing backup.

Answer

Use S3 Cross-Region Replication (CRR) to move the backup files between regions.

Answer

Create a single global KMS key to be used across all AWS regions for backup encryption.

Question 15

A security engineer needs to provide a third-party audit team in Account B access to S3 objects in Account A. The objects are encrypted with a Customer Managed Key (CMK) in Account A. What combination of permissions is required to allow the auditors to download and decrypt the objects?

Accepted Answer

Grant the Account B role S3 permissions in Account A's bucket policy and update the KMS key policy in Account A to include the Account B role ARN in the 'Principal' element with kms:Decrypt permissions.. To access cross-account encrypted objects, the KMS key policy in Account A must grant the external principal (Account B's role) permission to use the key. Simply adding the role ARN to the Principal element is not enough; the key policy must explicitly allow the 'kms:Decrypt' action for that principal. Additionally, the IAM policy in Account B must also grant the 'kms:Decrypt' permission to the role, as KMS permissions are evaluated against both the key policy and the IAM policy.

Answer

Attach an IAM policy to the Account B role allowing kms:Decrypt on all resources and update the Account A S3 bucket policy to allow public access to the encrypted objects.

Answer

Use an S3 Access Point in Account A to grant access to Account B and enable the 'KMS PassThrough' flag on the Access Point configuration to manage decryption.

Answer

Create a cross-account IAM role in Account A that the auditors assume, then grant that role permissions to the S3 bucket only, as S3 handles KMS decryption automatically for assumed roles.

Question 16

A security team is reviewing their AWS KMS strategy. They want to ensure that their Customer Managed Keys (CMKs) are automatically rotated. Which TWO statements correctly describe the behavior of automatic key rotation in AWS KMS?

Accepted Answer

When a CMK is rotated, AWS KMS retains the old backing key material indefinitely to allow for the decryption of data that was encrypted with it.. Option A is correct because KMS retains old backing keys to decrypt existing data. Option C is correct because AWS Managed Keys are automatically rotated every year, and this is a non-configurable setting. Options B, D, and E are incorrect: B is false because rotation is not enabled by default for CMKs; D is false because asymmetric keys do not support automatic rotation; E is false because KMS does not re-encrypt existing data upon rotation.

Answer

Automatic key rotation is enabled by default for all Customer Managed Keys at the time of creation to ensure maximum security.

Answer

Enabling automatic rotation for an asymmetric CMK ensures that both the private and public key pairs are updated every 365 days.

Answer

Once a key is rotated, all existing S3 objects encrypted with the old key material are automatically re-encrypted with the new key material within 24 hours.

Question 17

Refer to the exhibit. A security engineer has applied this policy to a Customer Managed Key (CMK). What is the primary effect of this policy on the use of the KMS key?

Accepted Answer

It allows any principal to use the key for any KMS action, provided the request originates from the specified VPC endpoint.. The policy as described (using aws:sourceVpce) does not grant permissions; it only restricts them. For the policy to 'allow' access, it must be paired with an Allow effect and appropriate KMS actions. The current explanation implies the condition key itself grants access, which is technically incorrect; it acts as a filter on existing permissions.

Answer

It restricts the KMS key usage to only those AWS services that are natively integrated with the specified VPC endpoint in the local region.

Answer

It grants the VPC endpoint itself the administrative permissions to manage the KMS key lifecycle, including deletion and rotation.

Answer

It ensures that all data encrypted by this key can only be decrypted by resources residing within the subnet associated with the VPC endpoint.

Question 18

An organization wants to encrypt all existing and future EBS volumes in their account using a Customer Managed Key (CMK). They have several unencrypted EBS snapshots from previous years. What is the most efficient way to ensure all new volumes created from these snapshots are encrypted with the CMK?

Accepted Answer

Manually copy each unencrypted snapshot and select the CMK to create an encrypted version of the snapshot before launching a volume.. To ensure that volumes created from *existing unencrypted snapshots* are encrypted, those snapshots must be copied to new snapshots while specifying the Customer Managed Key (CMK). Enabling EBS encryption by default only applies to *new* volumes and snapshots created from scratch or from unencrypted volumes, but copying existing unencrypted snapshots is the correct way to handle historical unencrypted snapshots.

Answer

Enable EBS encryption by default for the AWS Region and specify the Customer Managed Key as the default encryption key.

Answer

Create an IAM policy that denies the ec2:CreateVolume action if the 'Encrypted' parameter is set to false and attach it to all users.

Answer

Use AWS Config to detect unencrypted EBS volumes and trigger an AWS Systems Manager Automation document to stop and encrypt them.

Question 19

A database team needs to migrate an unencrypted Amazon RDS for MySQL DB instance to an encrypted instance using a specific KMS Customer Managed Key (CMK). Which THREE steps are required to complete this migration?

Accepted Answer

Take a snapshot of the unencrypted RDS DB instance.. The explanation is accurate, but the question requires specific trap information to help students avoid common pitfalls.

Answer

Modify the existing RDS DB instance and enable the 'StorageEncrypted' parameter while specifying the KMS key ARN.

Answer

Enable the 'AutoMinorVersionUpgrade' feature to allow RDS to automatically apply encryption during the next maintenance window.

Question 20

A large-scale data lake on S3 contains billions of small objects encrypted with AWS KMS. The security team is concerned about the high cost of KMS API calls and the potential for hitting KMS request rate limits. Which solution should they implement to reduce costs and increase performance?

Accepted Answer

Enable S3 Bucket Keys for the buckets to reduce the request traffic from S3 to AWS KMS.. S3 Bucket Keys reduce the number of KMS API calls by creating a short-lived bucket-level key to derive unique keys for objects. Instead of a call to KMS for every single object operation, S3 uses the bucket key, which significantly lowers costs and reduces the risk of hitting KMS request throttling limits in high-volume environments.

Answer

Switch from using Customer Managed Keys (CMKs) to AWS Managed Keys (aws/s3), as managed keys have higher request limits and lower costs.

Answer

Implement an Amazon CloudFront distribution in front of the S3 bucket and enable 'Origin Request Caching' for KMS metadata.

Answer

Use S3 Batch Operations to re-encrypt all objects with SSE-S3 (AES-256) instead of SSE-KMS.