SCS-C02 Practice Exam 63 — 20 Questions

Question 1

A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that when an EC2 instance is launched, the attached EBS volumes are always encrypted using a specific customer managed key. Which action will enforce this?

Accepted Answer

Use a service control policy (SCP) to deny ec2:RunInstances if the volume encryption key is not the required key. Option D is correct because an SCP can deny ec2:RunInstances if the volume encryption key is not the required key. Option A is wrong because IAM roles do not enforce encryption at launch. Option B is wrong because KMS key policies control who can use the key, not which key is used. Option C is wrong because default encryption uses the account's default key, not necessarily the required key.

Answer

Create an IAM role that requires the ec2:RunInstances action to include the kms:KeyId condition

Answer

Configure the KMS key policy to allow only the specific key for EBS encryption

Answer

Enable encryption by default for EBS volumes in the account

Question 2

A company stores sensitive data in an S3 bucket with versioning enabled. They want to ensure that objects are encrypted at rest using SSE-KMS. A security audit reveals that some older object versions are encrypted with SSE-S3. What is the MOST efficient way to re-encrypt those older versions with SSE-KMS?

Accepted Answer

Use S3 Batch Operations to copy objects with SSE-KMS encryption. Option A is correct because S3 Batch Operations can copy objects in place, preserving versions and applying new encryption. Option B is wrong because lifecycle policies do not re-encrypt. Option C is wrong because S3 sync does not handle versioning. Option D is wrong because the S3 console does not have a bulk re-encrypt feature for versions.

Answer

Create a lifecycle policy to transition objects to a new storage class

Answer

Use the AWS CLI s3 sync command with the --sse aws:kms option

Answer

Manually re-upload the objects via the S3 console

Question 3

A company is designing a data protection strategy for an Amazon RDS for MySQL database. The database is 2 TB in size and stores financial data. The compliance team requires that database snapshots be encrypted at rest and that encryption keys be rotated every year. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable automatic key rotation in AWS KMS for the KMS key used for RDS encryption. Option C is correct because enabling automatic key rotation in KMS once a year rotates the backing key, and snapshots are encrypted with the key. Option A is wrong because manual snapshot export is complex. Option B is wrong because separate keys for each snapshot add overhead. Option D is wrong because copying snapshots with a new key is manual and time-consuming.

Answer

Copy each snapshot to a new snapshot encrypted with a new KMS key

Answer

Export snapshots to S3 and use S3 Batch Operations to re-encrypt them

Answer

Use a different KMS key for each snapshot and rotate the key manually

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. The security team receives an alert that an IAM user is attempting to decrypt data using a key that they do not have access to. Which AWS service can be used to monitor and alert on such unauthorized KMS API calls?

Accepted Answer

AWS CloudTrail with CloudWatch Alarms. Option B is correct because CloudTrail logs all KMS API calls, and CloudWatch Alarms can trigger alerts on specific events. Option A is wrong because GuardDuty focuses on threat detection, not specific API calls. Option C is wrong because Config monitors resource configurations, not API calls. Option D is wrong because Inspector is for vulnerability assessment.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Inspector

Question 5

A company uses S3 to store confidential documents. They want to ensure that objects are encrypted at rest using customer-provided encryption keys (SSE-C). Which header must be included in every PUT request?

Accepted Answer

x-amz-server-side-encryption-customer-algorithm: AES256. Option A is correct because SSE-C requires x-amz-server-side-encryption-customer-algorithm to be set to AES256. Option B is wrong because that header is for SSE-S3. Option C is wrong for SSE-KMS. Option D is wrong because the key header must be provided separately.

Answer

x-amz-server-side-encryption: AES256

Answer

x-amz-server-side-encryption-customer-key: <key>

Answer

x-amz-server-side-encryption: aws:kms

Question 6

A company has a compliance requirement to encrypt all data in Amazon S3 using keys that are managed by the company's internal security team. The keys must be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which AWS service should be used?

Accepted Answer

AWS CloudHSM. Option B is correct because CloudHSM provides dedicated HSMs that are FIPS 140-2 Level 3 certified. Option A is wrong because KMS is Level 2 overall (though some regions have Level 3, but not fully). Option C is wrong because S3 does not provide HSM storage. Option D is wrong because Secrets Manager does not store keys in HSMs.

Answer

AWS Secrets Manager

Answer

AWS Key Management Service (KMS)

Answer

Amazon S3 default encryption with SSE-C

Question 7

A company is designing a data protection strategy for sensitive customer data stored in Amazon S3. Which TWO actions should be taken to protect the data from accidental deletion?

Accepted Answer

Enable MFA Delete on the S3 bucket.. Options A and D are correct. MFA Delete adds an extra authentication factor for delete operations. S3 Versioning allows recovery of deleted objects. Option B is wrong because bucket policies do not prevent deletion by authorized users. Option C is wrong because cross-region replication does not protect against deletion in the source bucket. Option E is wrong because lifecycle policies can delete objects.

Answer

Use S3 Object Lock with retention mode.

Answer

Enable cross-region replication to another bucket.

Answer

Configure an S3 bucket policy that denies s3:DeleteObject for all principals.

Question 8

A security engineer needs to protect data in transit between an EC2 instance and an RDS database. The RDS database uses SSL/TLS certificates. What is the MOST secure way to ensure that the connection is encrypted?

Accepted Answer

Download the RDS CA certificate to the EC2 instance and configure the database client to use SSL and verify the certificate.. Option B is correct because downloading the RDS CA certificate and requiring SSL on the client side ensures the connection is encrypted and verifies the server identity. Option A is wrong because using a self-signed certificate without verification can lead to MITM attacks. Option C is wrong because encryption in transit is not automatic; the client must initiate SSL. Option D is wrong because an IAM policy cannot enforce SSL on the database connection.

Answer

Configure the EC2 instance to use a self-signed certificate for SSL connections.

Answer

Enable encryption at rest on the RDS instance to automatically encrypt in-transit traffic.

Answer

Create an IAM policy that requires SSL connections to the RDS endpoint.

Question 9

A company is migrating on-premises data to AWS using AWS Snowball Edge. The data must be encrypted in transit and at rest. Which combination of steps should be taken?

Accepted Answer

Use Snowball Edge with default encryption settings; data is encrypted at rest and in transit.. Option A is correct because Snowball Edge automatically encrypts data at rest using AES-256 and uses TLS for transfer. Option B is incorrect because VPN is not used with Snowball. Option C is incorrect because KMS is not directly used for Snowball encryption. Option D is incorrect because client-side encryption is not required by default.

Answer

Encrypt the data with a client-side tool before copying to Snowball Edge.

Answer

Set up a VPN connection to AWS and transfer data over the VPN.

Answer

Use AWS KMS to generate a key and apply it to the Snowball Edge device.

Question 10

A company needs to encrypt data at rest in Amazon RDS for SQL Server. Which TWO methods can be used? (Choose two.)

Accepted Answer

Use SQL Server Transparent Data Encryption (TDE).. Options A and B are correct. Enabling encryption at launch encrypts the entire instance, and Transparent Data Encryption (TDE) is a SQL Server feature for encryption. Option C is incorrect because column-level encryption is possible but not native to RDS. Option D is incorrect because SSL/TLS encrypts data in transit, not at rest. Option E is incorrect because client-side encryption is not an RDS feature.

Answer

Use a client-side encryption library.

Answer

Use column-level encryption with Always Encrypted.

Answer

Use SSL/TLS certificates to encrypt the connection.

Question 11

A company wants to protect data in transit between its on-premises network and Amazon VPC using IPsec VPN. Which AWS service should be used to establish this VPN connection?

Accepted Answer

AWS Site-to-Site VPN. Option A is correct because AWS Site-to-Site VPN provides IPsec VPN connections between on-premises networks and VPCs. Option B is incorrect because AWS Direct Connect is a dedicated connection, not IPsec VPN. Option C is incorrect because Client VPN is for individual users. Option D is incorrect because Transit Gateway is used to connect multiple VPCs, but the VPN connection is established using Site-to-Site VPN.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 12

A company needs to share an encrypted Amazon Machine Image (AMI) with another AWS account. The AMI was encrypted using a customer managed key (CMK) in AWS KMS. What steps are required to allow the target account to launch an EC2 instance from the shared AMI?

Accepted Answer

Modify the AMI launch permissions to include the target account and add the target account to the KMS key policy. Option A is correct because both the AMI and KMS key must be shared. Option B is wrong because sharing the AMI alone won't allow decryption. Option C is wrong because sharing the KMS key alone won't give AMI access. Option D is wrong because the key must be shared with the target account.

Answer

Copy the AMI and share the copy; the key is automatically shared

Answer

Only modify the AMI launch permissions to include the target account

Answer

Only add the target account to the KMS key policy

Question 13

A security engineer is investigating a potential data breach and finds this CloudTrail log entry. What does this entry indicate?

Accepted Answer

A user decrypted data using a KMS key. Option D is correct because the event shows a user calling Decrypt on a KMS key. Option A is wrong because it's a Decrypt, not an Encrypt. Option B is wrong because the key is specified. Option C is wrong because the user is identified.

Answer

A user encrypted data using a KMS key

Answer

An anonymous user accessed the KMS key

Answer

The KMS key was deleted

Question 14

A company wants to automate the detection of sensitive data in an S3 bucket. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to discover and classify sensitive data. Option B is correct. Option A is incorrect because GuardDuty is for threat detection. Option C is incorrect because Inspector is for vulnerability assessment. Option D is incorrect because Artifact provides compliance reports.

Answer

AWS Artifact

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 15

A company is using AWS KMS to encrypt S3 objects. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which KMS key policy configuration should be used?

Accepted Answer

Add a condition that allows decrypt only when kms:ViaService is s3.amazonaws.com and the caller role matches the specific role ARN.. Option A is correct because using kms:ViaService condition restricts key usage to requests originating from S3, and kms:CallerRole can be used to restrict to a specific role. Option B is wrong because it grants blanket decrypt to the role without conditions. Option C is wrong because it grants decrypt to all roles. Option D is wrong because it restricts to a specific user, not role.

Answer

Use an S3 bucket policy that denies decrypt for all principals except the specific IAM user.

Answer

Configure the IAM role with a policy that allows kms:Decrypt for the specific KMS key.

Answer

Attach a resource-based policy to the S3 bucket that grants decrypt permission to the IAM role.

Question 16

A company is using AWS KMS to encrypt data in Amazon S3 and Amazon RDS. Which THREE practices should be followed to ensure the security of the KMS keys?

Accepted Answer

Enable automatic key rotation for the KMS keys.. Options A, C, and E are correct. Key rotation is a security best practice. Granting least privilege access limits exposure. Using CloudTrail provides audit trail. Option B is wrong because sharing keys across accounts increases risk. Option D is wrong because disabling automatic rotation may be necessary but is not a security best practice.

Answer

Disable automatic key rotation to maintain control over the key material.

Answer

Share the KMS key across multiple AWS accounts using cross-account access.

Question 17

A company needs to securely store database credentials that are used by an application running on Amazon EC2. The credentials must be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option C is correct because AWS Secrets Manager securely stores secrets and supports automatic rotation. Option A is wrong because Systems Manager Parameter Store can store secrets but does not automatically rotate them without custom logic. Option B is wrong because IAM roles cannot store database credentials. Option D is wrong because KMS is a key management service, not a secret store.

Answer

AWS KMS

Answer

AWS IAM roles for EC2

Answer

AWS Systems Manager Parameter Store

Question 18

A security engineer needs to ensure that an Amazon RDS for MySQL database is encrypted at rest. Which action should be taken?

Accepted Answer

Create a new DB instance with encryption enabled.. Option B is correct because enabling encryption on the DB instance at creation time encrypts the database at rest. Option A is incorrect because encryption cannot be enabled on an existing unencrypted DB instance. Option C is incorrect because encryption is not applied per database. Option D is incorrect because RDS encryption does not require a client-side tool.

Answer

Use a client-side encryption tool to encrypt data before writing to the database.

Answer

Use AWS KMS to encrypt individual databases within the instance.

Answer

Enable encryption on an existing unencrypted DB instance.

Question 19

A security engineer created the above IAM policy for an S3 bucket. What does this policy accomplish?

Accepted Answer

It denies uploading objects unless they are encrypted with AWS KMS.. Option B is correct. The policy denies PutObject if server-side encryption is not AWS KMS (aws:kms). Option A is incorrect because it allows encryption with any SSE. Option C is incorrect because it denies SSE-S3. Option D is incorrect because the condition is on encryption, not on KMS key ID.

Answer

It allows uploading objects with any server-side encryption.

Answer

It denies uploading objects with SSE-S3 encryption.

Answer

It requires objects to be encrypted with a specific KMS key.

Question 20

A company stores sensitive documents in an S3 bucket. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted using server-side encryption with AWS KMS. Which S3 bucket feature should be configured?

Accepted Answer

Default encryption. Option B is correct because the default encryption setting on an S3 bucket can enforce SSE-KMS. Option A is incorrect because bucket policies enforce access, not encryption. Option C is incorrect because lifecycle policies manage object lifecycle. Option D is incorrect because versioning does not enforce encryption.

Answer

Versioning

Answer

Bucket policy

Answer

Lifecycle policy