SCS-C02 Exam Questions and Answers

A security team suspects that an attacker has compromised an EC2 instance and is using it to launch outbound DDoS attacks. The team needs to quickly isolate the instance while preserving forensic data. Which combination of actions should the team take? (Choose TWO.)

Apply a restrictive security group that blocks all outbound traffic.

This isolates the instance by preventing outbound connections while allowing forensic access via inbound rules if needed.

Modify the network ACL for the subnet to deny all outbound traffic.

Create a snapshot of the EBS volumes attached to the EC2 instance.

Snapshots preserve the current state of the volumes for forensic analysis.

Detach the instance from the Auto Scaling group.

Terminate the EC2 instance immediately.

Why: Applying a restrictive security group that blocks all outbound traffic immediately stops the EC2 instance from sending any network packets, including DDoS traffic, without terminating the instance. This preserves the running state and allows forensic data collection from the instance's memory and disk. Security groups act as a stateful virtual firewall at the instance level, so blocking outbound traffic effectively isolates the instance from the network.

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all API calls in the organization are logged and retained for at least one year. Which AWS services or features should be used to meet these requirements? (Choose TWO.)

Amazon GuardDuty with threat detection enabled.

AWS Config with recording enabled for all resources.

Amazon S3 lifecycle policy to transition logs to S3 Glacier after one year.

This ensures logs are retained and cost-effective.

VPC Flow Logs for all VPCs.

AWS CloudTrail with organization trail.

An organization trail logs API calls for all accounts in the organization.

Why: An Amazon S3 lifecycle policy can automatically transition CloudTrail log objects from S3 Standard to S3 Glacier after one year, meeting the retention requirement cost-effectively. Option E is correct because AWS CloudTrail with an organization trail logs all API calls across all accounts in the AWS Organization, ensuring comprehensive logging.

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Amazon CloudWatch Logs with S3 access log analysis.

S3 server access logs can be sent to CloudWatch Logs for monitoring and alerting.

AWS CloudTrail with S3 data event logging.

CloudTrail data events record S3 object-level operations, including GetObject for data downloads.

Amazon GuardDuty with anomaly detection.

GuardDuty uses machine learning to detect unusual data access patterns, such as large volumes from an unfamiliar IP.

AWS Config with compliance rules.

VPC Flow Logs.

Why: Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

A security engineer reviews the CloudTrail log entry in the exhibit. The engineer notices that an EC2 instance was launched using an AdminRole. Which additional information would help determine if this is a legitimate action or a potential compromise?

The AMI ID ami-0abcdef1234567890 is not a standard Amazon-provided AMI.

The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company.

Anomalous source IP is a common indicator of compromise.

The instance type m5.xlarge is unusually large compared to previous launches.

The security group sg-0123456789abcdef0 allows inbound SSH from 0.0.0.0/0.

Why: The source IP address 203.0.113.50 is from an unexpected geographic location not associated with the company. In CloudTrail, the `sourceIPAddress` field records the originating IP of the API call. If an AdminRole is used from an IP outside the company's known CIDR ranges or geographic regions, it strongly indicates a potential compromise—such as stolen credentials or an attacker using the role from an unauthorized network. This is a key indicator of anomalous behavior in threat detection.

During a security incident, a security engineer needs to verify whether an EC2 instance's security group allowed inbound SSH from a specific IP address at the time of the incident. Which AWS service or feature should the engineer use to obtain this historical information?

Amazon CloudTrail event history.

AWS Systems Manager Inventory.

VPC Flow Logs.

AWS Config configuration history.

AWS Config records the configuration of security groups over time, allowing you to see the rules at the time of the incident.

Why: AWS Config configuration history records changes to security group rules, including the addition or removal of inbound SSH allow rules. By querying the configuration history for the specific security group, the engineer can determine the exact state of the rules at the time of the incident, including whether a specific IP address was allowed. This is the only service that provides a historical record of security group rule configurations.

A security engineer is implementing automated incident response. The engineer wants to use AWS Lambda to automatically remediate GuardDuty findings. What is the recommended pattern to trigger the Lambda function?

Configure an Amazon EventBridge rule to match GuardDuty findings and invoke the Lambda function.

EventBridge is the recommended way to route GuardDuty findings to Lambda for automated remediation.

Subscribe the Lambda function to an SNS topic that GuardDuty publishes findings to.

Use CloudWatch Logs subscription filter to trigger Lambda on GuardDuty log entries.

Have the Lambda function poll the EC2 instance metadata for threat indicators.

Why: Amazon EventBridge is the recommended pattern because it natively integrates with AWS GuardDuty to receive all finding events in near real-time. By configuring an EventBridge rule that matches GuardDuty finding types (e.g., 'UnauthorizedAccess:EC2/SSHBruteForce'), you can directly invoke a Lambda function for automated remediation without polling or intermediate services. This pattern is serverless, event-driven, and follows AWS best practices for decoupled incident response.

Want more Threat Detection and Incident Response practice?

All Security Logging and Monitoring questions

Domain 2: Security Logging and Monitoring

18% of exam · 6 sample questions below

A security engineer wants to capture all DNS queries made by EC2 instances to detect potential data exfiltration. Which AWS service should be used to log the DNS requests?

Use Route 53 Resolver DNS Firewall with query logging

DNS Firewall can log DNS queries for VPCs.

Use Amazon GuardDuty

Enable VPC Flow Logs

Enable AWS CloudTrail

Why: Route 53 Resolver DNS Firewall with query logging is the correct choice because it is specifically designed to log all DNS queries made by EC2 instances that use the Route 53 Resolver. This service captures the domain names being queried, the source IP, and the response, enabling detection of DNS-based data exfiltration (e.g., DNS tunneling). It integrates directly with the VPC's DNS resolver, ensuring all outbound DNS traffic from EC2 instances is logged without additional agents.

A company uses AWS CloudTrail to log management events in all regions. The security team notices that some API calls made by an IAM user are not appearing in the CloudTrail event history. What is the most likely reason?

The user used the AWS Management Console, not the CLI

The trail is configured for a single region only

The API calls were read-only and excluded by default

CloudTrail event history only retains events for 90 days; older events are not visible

CloudTrail event history is limited to 90 days.

Why: D is correct because CloudTrail event history only retains the last 90 days of events. If the API calls were made more than 90 days ago, they would no longer appear in the event history, even though the trail itself may still be delivering log files to an S3 bucket for longer-term storage. The security team is likely looking at the event history rather than querying the S3 bucket or using Athena for older events.

A company requires real-time analysis of AWS CloudTrail logs to detect unauthorized API calls. The logs are stored in Amazon S3. Which architecture minimizes latency and cost?

Use AWS Glue to crawl S3 and load into Amazon Redshift for analysis

Send CloudTrail logs to Amazon CloudWatch Logs, then use a subscription filter to Amazon Kinesis Data Firehose delivering to Amazon OpenSearch Service

Enables near real-time streaming.

Query CloudTrail logs directly using Amazon Athena

Configure S3 event notifications to invoke an AWS Lambda function that writes to Amazon OpenSearch Service

Why: It provides the lowest-latency path for real-time analysis: CloudTrail logs are delivered to CloudWatch Logs in near real-time, and a subscription filter streams them to Kinesis Data Firehose, which buffers and delivers directly to Amazon OpenSearch Service for immediate indexing and search. This architecture avoids batch processing, minimizes data movement overhead, and uses managed services that scale automatically, keeping both latency and cost low.

A security engineer needs to be alerted when an IAM user attempts to modify an S3 bucket policy. Which method is the MOST efficient?

Enable VPC Flow Logs and analyze for S3 API traffic

Configure an AWS Config rule to detect changes and invoke a Lambda function

Create an Amazon CloudWatch Events rule that matches the PutBucketPolicy API call and triggers an SNS notification

CloudWatch Events can match API calls from CloudTrail.

Enable S3 server access logs and parse them for PutBucketPolicy entries

Why: Amazon CloudWatch Events (now Amazon EventBridge) can directly capture the PutBucketPolicy API call as a real-time event and trigger an SNS notification without any additional compute or polling. This is the most efficient method as it requires no log parsing, no custom code, and no additional infrastructure, providing immediate alerting with minimal overhead.

A company uses Amazon GuardDuty and wants to suppress low-severity findings that are known false positives. What is the recommended approach?

Configure a CloudWatch Events rule to ignore the findings

Manually delete the findings from the GuardDuty console

Disable the GuardDuty detector for the affected accounts

Create a GuardDuty filter to suppress the findings

Filters can suppress findings from appearing in the console.

Why: GuardDuty filters allow you to automatically suppress low-severity findings that are known false positives by setting the filter action to 'ARCHIVE'. This prevents the findings from appearing in the active findings list without disabling detection or deleting data. Filters are the recommended approach because they are purpose-built for this use case and preserve the audit trail.

A company stores sensitive data in Amazon S3 and wants to detect and alert on any public read access to objects. Which combination of services provides the most comprehensive solution?

Enable VPC Flow Logs and analyze for S3 traffic

Use AWS Config rules to check for public bucket policies and alert via SNS

Enable S3 server access logging and use Amazon Athena to query logs, with CloudWatch Events to alert on specific patterns

Server access logs record requester, so public reads can be identified.

Enable S3 event notifications for all object-level events and send to Amazon SNS

Why: S3 server access logs capture detailed records of all requests made to a bucket, including the requester, bucket name, request time, action, and response status. By using Amazon Athena to query these logs and CloudWatch Events to trigger alerts on patterns indicating public read access (e.g., a specific HTTP method like GET from an anonymous principal), you can detect and alert on unauthorized public reads comprehensively. This combination provides granular, queryable logging with event-driven alerting, covering both current and historical access patterns.

Want more Security Logging and Monitoring practice?

All Identity and Access Management questions

Domain 3: Identity and Access Management

16% of exam · 6 sample questions below

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which policy should be attached to the IAM user?

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::my-bucket"}]}

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}]}

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}

Correctly allows read-only access to objects in the bucket.

Why: Option D grants s3:GetObject, which allows the IAM user to read (download) objects from the bucket. Although full read-only access typically includes s3:ListBucket to list objects, the question asks for read access, and s3:GetObject is the essential read action. Option A only allows listing, not reading object data. Option B grants full access, and option C grants write access. Thus, D is the best choice for read-only access.

An IAM policy includes the following condition: "StringNotEquals": {"aws:SourceArn": "arn:aws:ec2:us-east-1:123456789012:instance/*"}. What is the effect of this condition when attached to an IAM role?

Denies all requests from EC2 instances

Allows the role to be assumed only by EC2 instances in the specified account and region

Denies requests that do not originate from an EC2 instance in the specified account and region

Correct interpretation: Denies if SourceArn is not equal to the given ARN pattern.

Allows any request that comes from an EC2 instance regardless of account

Why: The condition uses `StringNotEquals` with `aws:SourceArn`, meaning it denies access when the source ARN does NOT match the specified pattern. Since the condition is attached to a role's trust policy, it restricts which principals can assume the role. The correct effect is that requests not originating from an EC2 instance in account 123456789012 and region us-east-1 are denied.

An IAM user receives an 'AccessDenied' error when trying to list objects in an S3 bucket. The user has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}]}. What is the most likely reason?

The policy is missing a condition

The bucket policy explicitly denies the action

An explicit deny in the bucket policy overrides the user policy allow.

The policy does not include s3:GetObject

The policy has a syntax error

Why: The IAM policy grants the s3:ListBucket action on the bucket, which should allow listing objects. However, an explicit deny in a bucket policy overrides any allow, including those from IAM policies. Since the user receives an 'AccessDenied' error, the most likely cause is that the bucket policy explicitly denies the s3:ListBucket action for this user, as explicit denies take precedence over all allows.

A company wants to allow users from its corporate Active Directory to access AWS resources. The company has set up an IAM identity provider for SAML. What must be created in IAM to map users to permissions?

An IAM role with a trust policy for the SAML provider

The role trust policy allows the SAML provider to issue tokens for the role.

An OIDC identity provider

An IAM user for each Active Directory user

A federation role type

Why: A is correct because when using SAML-based federation, IAM roles are the mechanism to grant permissions to federated users. The role must have a trust policy that specifies the SAML identity provider as the principal, allowing users authenticated by the corporate Active Directory to assume the role and obtain temporary AWS credentials. This maps the SAML assertion attributes (such as the user's group or role) to IAM permissions via the role's permissions policy.

An IAM policy has the following statement: {"Effect":"Deny","Action":"*","Resource":"*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. What does this policy achieve?

Denies all actions that are not made over HTTPS

Correctly denies when SecureTransport is false.

Allows all actions only when using HTTPS

Enforces HTTPS for S3 bucket policies only

Blocks all actions for a specific AWS service

Why: This policy statement uses the `aws:SecureTransport` condition key with a `Bool` condition set to `false`. When the condition evaluates to true (i.e., the request is not using HTTPS/TLS), the `Deny` effect applies to all actions on all resources. This effectively denies any API call made over HTTP (non-secure transport), ensuring that only HTTPS requests are allowed. The policy does not explicitly allow anything; it only denies non-HTTPS traffic, so all actions are implicitly allowed when made over HTTPS.

A solutions architect needs to design a system where an EC2 instance can write logs to CloudWatch Logs. Which IAM entity should be used to grant permissions to the EC2 instance?

A resource-based policy on the EC2 instance

An IAM role with an instance profile

Role with instance profile provides temporary credentials to the instance.

An IAM user with access keys stored on the instance

An IAM group

Why: An IAM role with an instance profile is the correct approach because it allows the EC2 instance to assume temporary, rotated credentials via the AWS Security Token Service (STS). The instance profile is attached to the EC2 instance, and the AWS SDK or CLI automatically retrieves credentials from the instance metadata service (IMDS) to authenticate API calls to CloudWatch Logs. This eliminates the need to store long-term credentials on the instance and follows the principle of least privilege.

Want more Identity and Access Management practice?

All Management and Security Governance questions

Domain 4: Management and Security Governance

14% of exam · 6 sample questions below

A company uses AWS Config to evaluate resource compliance. The security team notices that the AWS::IAM::Group resource type is not supported by AWS Config managed rules. What is the best way to detect IAM groups that have an inline policy allowing 'iam:CreateUser'?

Create a custom AWS Config rule using a Lambda function that evaluates IAM groups

Lambda-backed Config rules can evaluate unsupported resource types via API calls.

Use IAM Access Analyzer to identify policies that grant broad access

Use AWS CloudTrail Insights to detect CreateUser events

Enable AWS Config advanced query and run a query on IAM groups

Why: AWS Config managed rules do not support the AWS::IAM::Group resource type, so you cannot use a managed rule to evaluate inline policies on IAM groups. The best approach is to create a custom AWS Config rule backed by a Lambda function that can evaluate the IAM group's inline policies and trigger a compliance check when the group configuration changes. This allows you to detect any inline policy that contains the 'iam:CreateUser' action.

A security team needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record policy changes?

Amazon Inspector

AWS CloudTrail

CloudTrail logs all API calls, including IAM policy changes.

Amazon GuardDuty

AWS Config

Why: AWS CloudTrail is the correct service because it records all API calls made in the AWS account, including IAM policy changes (e.g., CreatePolicy, PutRolePolicy, AttachUserPolicy). These events are captured as CloudTrail log entries, providing a complete audit trail of who made the change, when, and from which source IP. This directly meets the requirement to audit all changes to IAM policies.

A company uses AWS Organizations with SCPs. The security team wants to ensure that no IAM user can be created without MFA. Which SCP should be applied at the root OU?

Deny iam:CreateUser unconditionally

Use an IAM policy to require MFA for API calls

Deny iam:CreateUser unless the request includes a condition for MFA

This SCP denies creation of users without MFA requirement.

Attach an IAM policy to all users requiring MFA

Why: It uses a Service Control Policy (SCP) to deny the `iam:CreateUser` action unless the request includes a condition that MFA is present. SCPs are account-level permission boundaries in AWS Organizations, and this approach ensures that no IAM user can be created without MFA across all accounts in the organization, as SCPs are evaluated before any IAM policies.

A security engineer needs to ensure that all EC2 instances launched in a development account are tagged with a cost center. What is the most effective way to enforce this?

Use AWS Config to detect untagged instances and send alerts

Use AWS Systems Manager to tag instances after launch

Create a tag policy in AWS Organizations requiring the cost center tag

Use an IAM policy that denies ec2:RunInstances unless the request includes the cost center tag

This prevents launching instances without the required tag.

Why: Using an IAM policy with a condition key (e.g., `aws:RequestTag`) that denies `ec2:RunInstances` unless the `cost center` tag is specified in the API call enforces tagging at launch time. This prevents any untagged instance from being created, providing proactive enforcement rather than reactive detection or remediation.

A company wants to centrally manage access keys for IAM users. Which AWS service can generate and rotate access keys automatically?

AWS CloudHSM

AWS KMS

AWS Systems Manager Parameter Store

AWS Secrets Manager

Secrets Manager can rotate IAM access keys automatically.

Why: AWS Secrets Manager is the correct service because it natively supports automatic rotation of secrets, including IAM user access keys. You can configure a rotation schedule (e.g., every 30 days) and Secrets Manager will generate a new access key pair, update the IAM user, and optionally disable or delete the old key. This provides a fully managed, centralized solution for rotating access keys without custom scripting.

A company uses AWS Config to record resources. Which TWO actions can be taken to automatically remediate non-compliant resources detected by AWS Config rules?

Configure AWS Config rules to invoke an AWS Lambda function for remediation

Lambda can be used for custom remediation.

Configure AWS Config rules to send notifications to an SNS topic

Use AWS Systems Manager Automation documents as remediation actions

SSM Automation can perform remediation steps.

Use AWS CloudTrail to log non-compliant events

Use Amazon CloudWatch Events to trigger an AWS Step Functions state machine

Why: AWS Config rules can be configured with remediation actions that invoke an AWS Lambda function. When a resource is evaluated as non-compliant, the rule triggers the Lambda function, which can execute custom logic to modify or fix the resource, such as adjusting security group rules or enabling encryption. This provides automated, programmable remediation directly integrated with AWS Config's evaluation lifecycle.

Want more Management and Security Governance practice?

All Infrastructure Security questions

Domain 5: Infrastructure Security

20% of exam · 6 sample questions below

A security engineer is reviewing the SQS queue policy shown in the exhibit. The queue is subscribed to an SNS topic in the same account. The security team has a requirement that only the SNS topic should be allowed to send messages to the queue. What is the issue with this policy?

The second statement allows any principal in the 10.0.0.0/8 range to receive messages from the queue.

This is overly permissive and should be scoped down.

The policy does not specify a principal, so it will not work.

The aws:SourceArn condition uses ArnLike which is deprecated.

The aws:SourceIp condition cannot be used with SQS queue policies.

Why: The second statement in the SQS queue policy allows any principal in the 10.0.0.0/8 IP range to receive messages from the queue, which violates the security requirement that only the SNS topic should be allowed to send messages. The policy should restrict the `sqs:SendMessage` action to the SNS topic using a condition like `aws:SourceArn` and should not include a broad `Effect: Allow` for `sqs:ReceiveMessage` without restricting the principal or source.

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.

Add a route in the private subnet's route table pointing to the NAT gateway.

Correct: This routes outbound internet traffic through the NAT gateway.

Attach an internet gateway to the private subnet's route table.

Create a VPC gateway endpoint for Amazon S3.

Deploy a NAT gateway in a public subnet.

Correct: NAT gateway enables outbound internet access from private subnets.

Why: A NAT gateway, when deployed in a public subnet with an associated Elastic IP and a route to an internet gateway, allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's private IP address to forward outbound traffic through it.

Drag and drop the steps to set up AWS Certificate Manager (ACM) for a custom domain in the correct order.

Request certificate, Validate domain ownership via DNS, Issue certificate, Associate certificate with AWS resource

This is the correct order because you must first request the certificate, then validate ownership of the domain (typically via DNS), after which AWS issues the certificate, and finally you associate it with the desired resource (e.g., CloudFront or ALB).

Validate domain ownership via DNS, Request certificate, Issue certificate, Associate certificate with AWS resource

Request certificate, Issue certificate, Validate domain ownership via DNS, Associate certificate with AWS resource

Request certificate, Validate domain ownership via DNS, Associate certificate with AWS resource, Issue certificate

Why: ACM certificate requires request, DNS validation, issuance, association, and automatic renewal.

Match each AWS Storage service encryption feature to its description.

SSE-S3: Encryption keys are managed by Amazon S3.

SSE-S3 uses server-side encryption where Amazon S3 manages the encryption keys, providing a simple encryption solution without customer key management.

SSE-KMS: Encryption keys are managed by the customer using AWS KMS.

SSE-KMS allows customers to use AWS Key Management Service (KMS) to manage their own encryption keys, offering more control and audit capabilities.

Client-side encryption: Encryption is performed on the client side before data is sent to S3.

Client-side encryption requires the customer to encrypt data locally before uploading it to Amazon S3, ensuring no plaintext data is transmitted to AWS.

EBS encryption: Encryption is applied at the application level.

Glacier encryption: Encryption is optional for data at rest.

Why: AWS storage services offer various encryption options. S3 SSE-S3 and SSE-KMS are server-side encryption methods with different key management approaches. Client-side encryption occurs before data upload. EBS encryption is transparent block-level encryption, and Glacier automatically encrypts data at rest.

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

S3 Interface Endpoint in the VPC

VPC Peering to a shared services VPC

NAT Gateway in a public subnet

Allows outbound internet to EC2 instances in private subnets.

Internet Gateway attached to the VPC

S3 Gateway Endpoint in the VPC

Provides private connectivity to S3 without internet.

Why: A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates or API calls) while blocking unsolicited inbound connections. This satisfies the requirement for outbound internet access without exposing private instances directly.

A company is using AWS WAF to protect its Application Load Balancer (ALB). The security team wants to block requests that do not contain a valid API key in the HTTP header 'X-API-Key'. Which WAF rule type should be used?

String match condition

Regex pattern set

Can define a pattern for valid API keys and block invalid ones.

Rate-based rule

IP set

Why: A regex pattern set rule is the correct choice because it allows you to define a regular expression pattern that matches the expected format of valid API keys in the 'X-API-Key' header. AWS WAF regex pattern sets can be used in a rule to inspect the header value and block requests that do not match the pattern, providing flexible and precise validation beyond simple string matching.

Want more Infrastructure Security practice?

All Data Protection questions

Domain 6: Data Protection

18% of exam · 6 sample questions below

A company stores sensitive data in Amazon S3 and wants to ensure that all objects are encrypted at rest. The security team has enabled default encryption on the S3 bucket using SSE-S3. However, an audit reveals that some objects are stored with SSE-KMS. How can the company enforce that only SSE-S3 is used for all future uploads, while still allowing existing SSE-KMS objects to be read?

Configure a bucket policy that denies s3:PutObject with s3:x-amz-server-side-encryption-aws:kms.

Use an S3 Lifecycle policy to transition existing SSE-KMS objects to SSE-S3.

Apply a bucket policy that denies s3:PutObject unless the x-amz-server-side-encryption header is AES256.

This policy enforces SSE-S3 for uploads without affecting reads of existing objects.

Disable SSE-KMS in the AWS KMS key policy to prevent its use.

Why: It uses a bucket policy to deny s3:PutObject unless the x-amz-server-side-encryption header is set to AES256, which is the value for SSE-S3. This enforces that all future uploads use SSE-S3, while existing SSE-KMS objects remain readable because the policy only applies to write operations. The condition key s3:x-amz-server-side-encryption checks the encryption header value, and the Deny effect overrides any Allow, ensuring compliance.

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.

CloudHSM provides a dedicated HSM that you control, and RDS can be encrypted using keys from CloudHSM.

Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.

Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.

Use AWS KMS with a custom key store backed by AWS CloudHSM.

Why: AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.

A company is designing a data protection strategy for its Amazon S3 bucket that stores sensitive documents. The security team requires that all data be encrypted in transit and at rest, and that any accidental deletion of objects can be reversed within 30 days. Additionally, the company must be able to audit all access attempts to the bucket, including failed attempts. Which TWO actions should the company take to meet these requirements? (Choose two.)

Enable default encryption on the bucket using SSE-S3.

Enable AWS CloudTrail with data events for S3.

CloudTrail logs all API calls, including failed ones, for auditing.

Enable S3 Versioning on the bucket.

Versioning allows recovery of deleted objects within the version retention period.

Enable S3 server access logs and send them to a separate bucket.

Enable MFA Delete on the bucket.

Why: AWS CloudTrail with data events for S3 is correct because it captures all S3 API calls, including GetObject, PutObject, and DeleteObject, and records both successful and failed access attempts. This meets the auditing requirement for all access attempts, including failed ones, as CloudTrail logs the request details, error codes, and source IP addresses.

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Configure the target group to use HTTPS protocol.

HTTPS target group ensures encryption between ALB and EC2.

Enable encryption at rest on the EC2 instances.

Use a network load balancer instead of an ALB.

Assign a certificate from ACM to the ALB listener.

Configure the ALB listener to use HTTPS protocol.

HTTPS listener enables encryption between client and ALB.

Why: Configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.

Refer to the exhibit. An AWS KMS key policy includes the statement shown. The AdminRole tries to decrypt a ciphertext that was encrypted using the same KMS key with encryption context 'department=engineering'. What will happen?

The decrypt operation succeeds because the role has kms:Decrypt permission.

The decrypt operation succeeds because the encryption context is ignored during decryption.

The decrypt operation fails because the policy does not allow kms:Decrypt without matching context.

The decrypt operation fails because the encryption context does not match the condition.

The condition 'department=finance' is not met, so access is denied.

Why: The KMS key policy includes a condition that requires the encryption context to be 'department=finance' for decryption. When the AdminRole attempts to decrypt, the encryption context must match both the encryption context used during encryption and any conditions in the key policy. Since the ciphertext was encrypted with 'department=engineering', the decryption fails because the encryption context does not satisfy the policy condition, even though the role has kms:Decrypt permission.

Match each AWS security-related acronym to its definition.

SOC: Report on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.

SOC reports are designed to assess and report on controls at service organizations, covering these five trust service criteria.

PCI DSS: Set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment.

PCI DSS is the Payment Card Industry Data Security Standard, required for entities handling credit card data.

HIPAA: US law designed to provide privacy standards to protect patients' medical records and other health information.

HIPAA (Health Insurance Portability and Accountability Act) sets national standards for protecting medical records and personal health information.

FedRAMP: US government program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services.

FedRAMP (Federal Risk and Authorization Management Program) provides a standardized approach for cloud service providers to gain federal authorization.

SOC: US law designed to provide privacy standards to protect patients' medical records and other health information.

PCI DSS: US government program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services.

Why: The correct matches are: SOC with service organization controls, PCI DSS with credit card security, HIPAA with healthcare privacy, and FedRAMP with cloud authorization. Common confusions include mixing HIPAA with SOC and PCI DSS with FedRAMP.

Want more Data Protection practice?