SCS-C03 Data Protection Practice Test 2 — 15 Questions

Question 1

A security team is reviewing their AWS KMS strategy. They want to ensure that their Customer Managed Keys (CMKs) are automatically rotated. Which TWO statements correctly describe the behavior of automatic key rotation in AWS KMS?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

When a CMK is rotated, AWS KMS retains the old backing key material indefinitely to allow for the decryption of data that was encrypted with it.. Option A is correct because KMS retains old backing keys to decrypt existing data. Option C is correct because AWS Managed Keys are automatically rotated every year, and this is a non-configurable setting. Options B, D, and E are incorrect: B is false because rotation is not enabled by default for CMKs; D is false because asymmetric keys do not support automatic rotation; E is false because KMS does not re-encrypt existing data upon rotation.

Answer

Automatic key rotation is enabled by default for all Customer Managed Keys at the time of creation to ensure maximum security.

Answer

Enabling automatic rotation for an asymmetric CMK ensures that both the private and public key pairs are updated every 365 days.

Answer

Once a key is rotated, all existing S3 objects encrypted with the old key material are automatically re-encrypted with the new key material within 24 hours.

Question 2

Refer to the exhibit. A security engineer has applied this policy to a Customer Managed Key (CMK). What is the primary effect of this policy on the use of the KMS key?

Accepted Answer

It allows any principal to use the key for any KMS action, provided the request originates from the specified VPC endpoint.. The policy as described (using aws:sourceVpce) does not grant permissions; it only restricts them. For the policy to 'allow' access, it must be paired with an Allow effect and appropriate KMS actions. The current explanation implies the condition key itself grants access, which is technically incorrect; it acts as a filter on existing permissions.

Answer

It restricts the KMS key usage to only those AWS services that are natively integrated with the specified VPC endpoint in the local region.

Answer

It grants the VPC endpoint itself the administrative permissions to manage the KMS key lifecycle, including deletion and rotation.

Answer

It ensures that all data encrypted by this key can only be decrypted by resources residing within the subnet associated with the VPC endpoint.

Question 3

An organization wants to encrypt all existing and future EBS volumes in their account using a Customer Managed Key (CMK). They have several unencrypted EBS snapshots from previous years. What is the most efficient way to ensure all new volumes created from these snapshots are encrypted with the CMK?

Accepted Answer

Manually copy each unencrypted snapshot and select the CMK to create an encrypted version of the snapshot before launching a volume.. To ensure that volumes created from *existing unencrypted snapshots* are encrypted, those snapshots must be copied to new snapshots while specifying the Customer Managed Key (CMK). Enabling EBS encryption by default only applies to *new* volumes and snapshots created from scratch or from unencrypted volumes, but copying existing unencrypted snapshots is the correct way to handle historical unencrypted snapshots.

Answer

Enable EBS encryption by default for the AWS Region and specify the Customer Managed Key as the default encryption key.

Answer

Create an IAM policy that denies the ec2:CreateVolume action if the 'Encrypted' parameter is set to false and attach it to all users.

Answer

Use AWS Config to detect unencrypted EBS volumes and trigger an AWS Systems Manager Automation document to stop and encrypt them.

Question 4

A database team needs to migrate an unencrypted Amazon RDS for MySQL DB instance to an encrypted instance using a specific KMS Customer Managed Key (CMK). Which THREE steps are required to complete this migration?

Accepted Answer

Take a snapshot of the unencrypted RDS DB instance.. The explanation is accurate, but the question requires specific trap information to help students avoid common pitfalls.

Answer

Modify the existing RDS DB instance and enable the 'StorageEncrypted' parameter while specifying the KMS key ARN.

Answer

Enable the 'AutoMinorVersionUpgrade' feature to allow RDS to automatically apply encryption during the next maintenance window.

Question 5

A large-scale data lake on S3 contains billions of small objects encrypted with AWS KMS. The security team is concerned about the high cost of KMS API calls and the potential for hitting KMS request rate limits. Which solution should they implement to reduce costs and increase performance?

Accepted Answer

Enable S3 Bucket Keys for the buckets to reduce the request traffic from S3 to AWS KMS.. S3 Bucket Keys reduce the number of KMS API calls by creating a short-lived bucket-level key to derive unique keys for objects. Instead of a call to KMS for every single object operation, S3 uses the bucket key, which significantly lowers costs and reduces the risk of hitting KMS request throttling limits in high-volume environments.

Answer

Switch from using Customer Managed Keys (CMKs) to AWS Managed Keys (aws/s3), as managed keys have higher request limits and lower costs.

Answer

Implement an Amazon CloudFront distribution in front of the S3 bucket and enable 'Origin Request Caching' for KMS metadata.

Answer

Use S3 Batch Operations to re-encrypt all objects with SSE-S3 (AES-256) instead of SSE-KMS.

Question 6

A financial institution stores highly sensitive customer records in an Amazon S3 bucket. Compliance regulations mandate that the encryption keys must be managed in an external key manager outside of AWS, but the decryption operations must occur inside AWS infrastructure under strict access control. Which encryption configuration meets these strict compliance requirements?

Accepted Answer

Establish an AWS KMS custom key store backed by an external key manager (CloudHSM) and configure SSE-KMS using these specific keys.. AWS CloudHSM is an AWS-managed service. While it provides FIPS 140-2 Level 3 compliance, it is not an 'external key manager outside of AWS'. The correct solution for keys managed outside of AWS is to use AWS KMS with 'Imported Key Material' (BYOK) or an External Key Store (XKS) via AWS KMS External Key Store (XKS) which integrates with external key managers like Thales or Entrust.

Answer

Configure server-side encryption with Amazon S3 managed keys (SSE-S3) and apply a bucket policy denying access to unencrypted objects.

Answer

Use server-side encryption with AWS KMS keys (SSE-KMS) utilizing default AWS managed keys generated automatically within the regional account.

Answer

Implement server-side encryption with customer-provided encryption keys (SSE-C) where the client transmits the key over HTTPS for every single request.

Question 7

A company stores sensitive PII in RDS MySQL databases. The security team wants to ensure that data is encrypted at rest and that the encryption keys are rotated annually. Which TWO actions fulfill these requirements?

Accepted Answer

Enable RDS encryption using a customer-managed key during instance creation.. Enabling RDS encryption at the time of instance creation is mandatory for at-rest protection, as this cannot be added to an existing unencrypted instance. Additionally, using AWS KMS customer-managed keys allows the administrator to control the rotation schedule manually or via automatic rotation features, ensuring the underlying cryptographic material is refreshed regularly to maintain compliance and reduce the potential impact of a compromised key.

Answer

Enable RDS encryption using an AWS managed key and configure annual rotation.

Answer

Modify the existing RDS instance to enable encryption after the initial launch.

Answer

Enable Transparent Data Encryption (TDE) via the RDS option group.

Question 8

A company needs to share an encrypted EBS volume snapshot with a partner's AWS account. The snapshot is encrypted with a customer-managed KMS key. What must the company do to enable this sharing?

Accepted Answer

Share the snapshot and update the KMS key policy to permit usage by the partner.. Sharing encrypted snapshots requires sharing both the snapshot and the associated KMS key. Because the partner account cannot use the owner's KMS key directly, the key policy must be modified to allow the partner account to use the key for decryption. This ensures the partner can access the encrypted data while maintaining the security of the encryption process through AWS KMS.

Answer

Copy the snapshot to an unencrypted state, then share the unencrypted snapshot.

Answer

Export the snapshot to an S3 bucket and provide the partner with the S3 URL.

Answer

Use AWS DataSync to copy the volume data directly to the partner account.

Question 9

An organization wants to rotate their KMS customer-managed keys every 90 days. What is the most effective way to implement this?

Accepted Answer

Perform manual key rotation by creating a new key every 90 days.. AWS KMS automatic rotation occurs every 365 days and cannot be configured for a 90-day interval. To meet a 90-day requirement, the organization must perform manual rotation. This involves creating a new key, updating the application's key ID configuration (or using an alias), and keeping the old key active only for decrypting existing data, which is a standard procedure for strict compliance.

Answer

Modify the KMS key's rotation policy to 90 days.

Answer

Use an AWS Lambda function to trigger the rotation of the KMS key backing material.

Answer

Use AWS Secrets Manager to rotate the KMS key every 90 days.

Question 10

An application in Account A needs to decrypt S3 objects in Account B using a KMS key in Account B. What is the minimal configuration required?

Accepted Answer

Update the IAM policy in Account A and the KMS key policy in Account B.. To enable cross-account access, the KMS key policy in Account B must explicitly permit the IAM role in Account A to perform 'kms:Decrypt'. Furthermore, the IAM role in Account A must also have an IAM policy granting it the permission to perform 'kms:Decrypt' on the specific KMS key ARN in Account B. Both policies must be present; if either is missing, the operation will fail.

Answer

Only update the IAM policy in Account A to allow 'kms:Decrypt'.

Answer

Only update the KMS key policy in Account B to allow the role from Account A.

Answer

Create an IAM user in Account B and provide credentials to the application.

Question 11

Which service should be used to protect sensitive data from being exfiltrated via API calls to unauthorized services?

Accepted Answer

VPC Endpoint Policies. VPC endpoints, specifically Interface Endpoints (powered by AWS PrivateLink), allow you to restrict traffic to specific AWS services. By using a VPC Endpoint Policy, you can restrict API calls to only those services you explicitly authorize. This provides a robust preventative control that stops data from being sent to unauthorized accounts or services, even if an identity is compromised.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

AWS Shield

Question 12

A company is migrating a legacy database to Amazon RDS for MySQL and must ensure the data is protected according to strict compliance standards. The security team requires that the data at rest is encrypted and that the encryption cannot be disabled after the instance is created. Which TWO statements accurately describe RDS encryption behavior?

Accepted Answer

Snapshots and automated backups of an encrypted RDS instance are automatically encrypted using the same KMS key.. Amazon RDS encryption at rest is a foundational security feature that must be decided at the time of resource creation. It uses the AES-256 encryption algorithm to protect data stored on the underlying volumes, as well as backups and snapshots. Understanding the lifecycle of encrypted instances is critical for maintaining a secure data environment.

Answer

Encryption at rest can be enabled for an existing unencrypted RDS DB instance by modifying the instance settings.

Answer

Encryption at rest can be disabled on an RDS instance to improve performance during large data imports.

Answer

RDS encryption at rest only protects the database tables and does not apply to logs or temporary files.

Question 13

An organization is using AWS Secrets Manager to store database credentials. The security policy requires that these credentials be rotated every 30 days. The database is hosted on Amazon RDS. What is the most secure and automated way to implement this requirement?

Accepted Answer

Enable rotation in Secrets Manager and use a provided Lambda template to update the RDS credentials.. AWS Secrets Manager integrates directly with Lambda to automate the rotation of secrets. For supported services like Amazon RDS, AWS provides pre-written Lambda templates that handle the complex logic of updating the password in the database and the secret value in Secrets Manager simultaneously, ensuring no service interruption occurs during the process.

Answer

Use an Amazon EventBridge rule to trigger a manual password reset on the RDS instance every 30 days.

Answer

Store the credentials in an S3 bucket with versioning and use a Lifecycle policy to rotate the files.

Answer

Configure the RDS instance to automatically pull new credentials from Secrets Manager using IAM roles.

Question 14

A security architect is designing a cross-account data sharing solution. Account A owns a KMS Customer Managed Key (CMK) that must be used by an IAM role in Account B to decrypt S3 objects. Which TWO steps are required to enable this cross-account access?

Accepted Answer

Modify the KMS key policy in Account A to grant the IAM role in Account B permission to use the key.. Cross-account access to a KMS key requires permissions to be granted in two places: the key policy (resource-based) and the IAM policy (identity-based). The key owner must trust the external account in the key policy, and the external account's administrator must then grant specific users or roles permission to use that key.

Answer

Create a VPC Peering connection between Account A and Account B to allow KMS traffic.

Answer

Configure the IAM role in Account B to assume a role in Account A that has KMS permissions.

Answer

Enable 'KMS Multi-Region' support on the key in Account A to allow it to be seen by Account B.

Question 15

A company wants to ensure that all new Amazon EBS volumes created in their account are automatically encrypted, regardless of whether the developer specifies encryption during the volume creation process. Which AWS feature should be used?

Accepted Answer

Enable 'EBS encryption by default' in the EC2 dashboard for each specific AWS region.. EBS encryption by default is a region-specific setting that ensures every new EBS volume and snapshot copy created in the account is encrypted. This provides a safety net for security compliance, ensuring that no unencrypted data is inadvertently stored on block storage due to human error or misconfigured automation scripts.

Answer

Create an IAM policy that denies the 'ec2:CreateVolume' action if the 'Encrypted' parameter is false.

Answer

Use an AWS Config rule to automatically delete any EBS volume that is found to be unencrypted.

Answer

Configure an S3 Bucket Policy to only allow encrypted EBS snapshots to be uploaded.