SCS-C02 Data Protection Practice Questions

Question 1

A company stores sensitive data in Amazon S3 and wants to ensure that all objects are encrypted at rest. The security team has enabled default encryption on the S3 bucket using SSE-S3. However, an audit reveals that some objects are stored with SSE-KMS. How can the company enforce that only SSE-S3 is used for all future uploads, while still allowing existing SSE-KMS objects to be read?

Accepted Answer

Apply a bucket policy that denies s3:PutObject unless the x-amz-server-side-encryption header is AES256.. It uses a bucket policy to deny s3:PutObject unless the x-amz-server-side-encryption header is set to AES256, which is the value for SSE-S3. This enforces that all future uploads use SSE-S3, while existing SSE-KMS objects remain readable because the policy only applies to write operations. The condition key s3:x-amz-server-side-encryption checks the encryption header value, and the Deny effect overrides any Allow, ensuring compliance.

Answer

Configure a bucket policy that denies s3:PutObject with s3:x-amz-server-side-encryption-aws:kms.

Answer

Use an S3 Lifecycle policy to transition existing SSE-KMS objects to SSE-S3.

Answer

Disable SSE-KMS in the AWS KMS key policy to prevent its use.

Question 2

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

Accepted Answer

Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.. AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.

Answer

Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.

Answer

Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.

Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.

Question 3

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Configure the target group to use HTTPS protocol.. Configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Use a network load balancer instead of an ALB.

Answer

Assign a certificate from ACM to the ALB listener.

Question 4

A company uses S3 to store sensitive customer data. The security team requires that all objects uploaded to S3 be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). A developer reports that some objects are being stored unencrypted. What is the MOST effective way to enforce this requirement?

Accepted Answer

Use a bucket policy to deny s3:PutObject if encryption is not set to aws:kms. A bucket policy that denies s3:PutObject unless the request specifies SSE-KMS (aws:kms) is the most effective enforcement because IAM/bucket policies are evaluated on every API call and cannot be bypassed by clients. The condition key s3:x-amz-server-side-encryption (or s3:RequestObjectTagKeys style conditions) lets you reject any PutObject that doesn't explicitly request aws:kms encryption. This ensures objects are encrypted with KMS-managed keys rather than merely defaulted to SSE-S3.

Answer

Enable default encryption on the bucket using SSE-S3

Answer

Use an SCP to deny s3:PutObject without encryption

Answer

Set a bucket policy to require the x-amz-server-side-encryption header

Question 5

A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that when an EC2 instance is launched, the attached EBS volumes are always encrypted using a specific customer managed key. Which action will enforce this?

Accepted Answer

Use a service control policy (SCP) to deny ec2:RunInstances if the volume encryption key is not the required key. A service control policy (SCP) in AWS Organizations can enforce that ec2:RunInstances is denied unless the EBS volume encryption key matches the required customer managed key. SCPs set the maximum permissions for accounts in an organization, so a deny statement with a condition on the KMS key ID effectively blocks launches that do not use the specified key.

Answer

Create an IAM role that requires the ec2:RunInstances action to include the kms:KeyId condition

Answer

Configure the KMS key policy to allow only the specific key for EBS encryption

Answer

Enable encryption by default for EBS volumes in the account

Question 6

A company stores sensitive data in an S3 bucket with versioning enabled. They want to ensure that objects are encrypted at rest using SSE-KMS. A security audit reveals that some older object versions are encrypted with SSE-S3. What is the MOST efficient way to re-encrypt those older versions with SSE-KMS?

Accepted Answer

Use S3 Batch Operations to copy objects with SSE-KMS encryption. S3 Batch Operations can efficiently copy objects in place, preserving all versions and applying new SSE-KMS encryption to older object versions. Option A is incorrect because lifecycle policies only move objects to different storage classes, they do not change encryption. Option B is incorrect because the s3 sync command does not handle versioned objects in this way and cannot re-encrypt existing versions. Option D is incorrect because manually re-uploading via the console is not efficient for many objects and does not easily preserve versioning.

Answer

Create a lifecycle policy to transition objects to a new storage class

Answer

Use the AWS CLI s3 sync command with the --sse aws:kms option

Answer

Manually re-upload the objects via the S3 console

Question 7

A company wants to protect data at rest for an Amazon S3 bucket that contains sensitive data. Which combination of actions provides the MOST comprehensive protection? (Choose two.)

Accepted Answer

Enable default encryption on the bucket with SSE-S3. Option B is correct because enabling default encryption with SSE-S3 ensures that every object uploaded to the bucket is automatically encrypted at rest using AES-256, directly satisfying the requirement to protect sensitive data at rest without relying on users to specify encryption headers. Option C is correct because a bucket policy that denies requests over HTTP (using a condition such as aws:SecureTransport: false) enforces encryption in transit via HTTPS/TLS, preventing sensitive data from being transmitted in cleartext and complementing at-rest encryption for comprehensive protection. Option A is not correct because versioning only preserves multiple object versions against overwrites or deletions; it does not encrypt data at rest. Option D is not correct because MFA Delete adds a safeguard against accidental or malicious deletion of object versions but does not provide encryption of data at rest. Option E is not correct because a lifecycle policy transitioning objects to Glacier changes the storage class for cost or retention purposes and does not itself encrypt data at rest.

Answer

Enable versioning on the bucket

Answer

Enable MFA Delete on the bucket

Answer

Configure a lifecycle policy to transition objects to Glacier

Question 8

A company uses S3 to store confidential documents. They want to ensure that objects are encrypted at rest using customer-provided encryption keys (SSE-C). Which header must be included in every PUT request?

Accepted Answer

x-amz-server-side-encryption-customer-algorithm: AES256. To use SSE-C, PUT requests must include several headers: the algorithm header, the encryption key, and the key MD5 hash. Option A (`x-amz-server-side-encryption: AES256`) is for SSE-S3, Option D (`x-amz-server-side-encryption: aws:kms`) is for SSE-KMS. Option B (`x-amz-server-side-encryption-customer-key`) is a required header for SSE-C, but it carries the key material, not the algorithm setting. Option C (`x-amz-server-side-encryption-customer-algorithm`) is the correct answer because it is the mandatory header that explicitly specifies the use of customer-provided encryption with AES256.

Answer

x-amz-server-side-encryption: AES256

Answer

x-amz-server-side-encryption-customer-key: <key>

Answer

x-amz-server-side-encryption: aws:kms

Question 9

A company has a compliance requirement to encrypt all data in Amazon S3 using keys that are managed by the company's internal security team. The keys must be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which AWS service should be used?

Accepted Answer

AWS CloudHSM. AWS CloudHSM provides dedicated, single-tenant hardware security modules that are FIPS 140-2 Level 3 validated, and the customer retains full control of the keys. Because the requirement specifies company-managed keys stored in a FIPS 140-2 Level 3 HSM, CloudHSM is the correct service. KMS uses multi-tenant HSMs that are FIPS 140-2 Level 3 validated but the keys are AWS-managed infrastructure, which does not meet the 'company's internal security team manages the keys in their own HSM' requirement.

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Answer

Amazon S3 default encryption with SSE-C

Question 10

A company uses Amazon S3 to store sensitive documents. They must ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which S3 bucket policy statement achieves this?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256 AND the encryption is SSE-S3.. Option C is correct because it explicitly denies PutObject unless the request includes both the x-amz-server-side-encryption header with value AES256 (which requests SSE-S3) and the encryption type is SSE-S3. This ensures only objects encrypted with SSE-S3 can be uploaded. Option A is incorrect because it only checks for the header value AES256; while AES256 is specific to SSE-S3 and would also enforce SSE-S3, Option C provides a more explicit condition. Option B is incorrect because it denies all PutObject requests. Option D is incorrect because an Allow statement cannot enforce a denial; a Deny statement is required to block unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256.

Answer

Deny s3:PutObject for all principals.

Answer

Allow s3:PutObject only when x-amz-server-side-encryption: AES256 is present.

Data Protection

SCS-C02 Data Protection — Key Topics

Where candidates lose marks on Data Protection