SCS-C02 Practice Exam 64 — 20 Questions

Question 1

A company stores data in Amazon S3 and wants to ensure that objects are encrypted at rest. The security team decides to use server-side encryption with AWS KMS (SSE-KMS). Which additional benefit does SSE-KMS provide over SSE-S3?

Accepted Answer

Separate permissions for key usage and audit of key usage. Option B is correct because SSE-KMS provides separate permissions for key usage and audit trails. Option A is wrong because both provide encryption. Option C is wrong because SSE-KMS can have additional cost. Option D is wrong because SSE-S3 also provides strong encryption.

Answer

Faster encryption and decryption

Answer

Lower cost per object

Answer

Stronger encryption algorithm

Question 2

A company uses S3 to store sensitive customer data. Which AWS service can automatically discover and classify this data to help meet compliance requirements?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in AWS. Option B is correct because Macie is designed for data discovery and classification. Option A is incorrect because AWS Config tracks resource configuration changes. Option C is incorrect because CloudWatch monitors performance and logs. Option D is incorrect because GuardDuty focuses on threat detection.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch

Question 3

A security engineer is tasked with ensuring that all data stored in an RDS DB instance is encrypted at rest. The database is already running and contains data. What should the engineer do?

Accepted Answer

Create a snapshot of the DB instance, copy it with encryption, and restore the encrypted snapshot. RDS does not support enabling encryption at rest on an existing DB instance. The correct approach is to create a snapshot, copy it with encryption, and restore. Option B is correct. Option A is incorrect because encryption cannot be enabled directly. Option C is incorrect because modifying the DB instance does not add encryption. Option D is incorrect because KMS key modification does not enable encryption.

Answer

Change the KMS key associated with the DB instance

Answer

Modify the DB instance to use an encrypted storage type

Answer

Enable encryption at rest in the RDS console for the existing DB instance

Question 4

A financial services company must ensure that all data at rest in Amazon RDS for PostgreSQL is encrypted. The current database is unencrypted. What is the MOST operationally efficient way to enable encryption?

Accepted Answer

Take a snapshot of the database, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. Option C is correct because RDS does not support direct encryption of existing unencrypted databases; you must create a snapshot, copy it with encryption, and restore. Option A is wrong because you cannot enable encryption on a running instance. Option B is wrong because enabling encryption on the fly is not supported. Option D is wrong because copying a snapshot without encryption is unnecessary.

Answer

Export the database to S3 using pg_dump, then import into a new encrypted RDS instance.

Answer

Create a read replica with encryption enabled and promote it to primary.

Answer

Enable encryption directly on the existing RDS instance by modifying the DB instance settings.

Question 5

A company needs to enforce encryption in transit for all traffic between an Amazon EC2 instance and an Amazon RDS database. Which TWO steps should be taken?

Accepted Answer

Enable TLS on the RDS database and configure the database to require encrypted connections.. Options C and E are correct. To enforce encryption in transit, you must enable TLS on the RDS instance and require encrypted connections from the client. Option A is wrong because security group rules do not enforce encryption. Option B is wrong because using a VPN does not enforce encryption at the database layer. Option D is wrong because enabling encryption at rest does not affect transit.

Answer

Configure security groups to allow traffic only on port 3306 (MySQL) or 5432 (PostgreSQL).

Answer

Set up a VPN connection between the EC2 instance and the RDS database.

Answer

Enable encryption at rest on the RDS instance.

Question 6

A company stores sensitive data in an S3 bucket. The security team wants to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). An application writes objects to the bucket but sometimes fails because the encryption key is not found. What is the MOST likely cause?

Accepted Answer

The KMS key is in a different AWS Region than the S3 bucket.. Option D is correct because SSE-KMS requires the KMS key to be in the same region as the S3 bucket; cross-region keys are not supported. Option A is wrong because SSE-S3 is not used. Option B is wrong because KMS keys do not expire. Option C is wrong because SSE-KMS does not require customer master key (CMK) rotation to be enabled.

Answer

The bucket policy does not allow SSE-KMS.

Answer

The KMS key has expired.

Answer

The KMS key does not have automatic rotation enabled.

Question 7

A company uses AWS KMS to manage encryption keys for sensitive data stored in S3. The security team wants to ensure that keys are rotated automatically every year. What should they do?

Accepted Answer

Use an AWS managed key, which rotates automatically every year.. Option C is correct because AWS managed KMS keys automatically rotate yearly. Option A is incorrect because customer managed keys do not auto-rotate by default. Option B is incorrect because key rotation is not disabled by default. Option D is incorrect because manual rotation is not automatic.

Answer

Enable automatic key rotation on a customer managed key.

Answer

Use a custom key store and rotate keys manually.

Answer

Use a CloudHSM to store keys and rotate them manually.

Question 8

A security engineer examines the above output. The company requires automatic yearly key rotation. What should the engineer do?

Accepted Answer

Run 'aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab'. Option A is correct because the key is a customer managed key (KeyRotationEnabled: false indicates it's not an AWS managed key). Enabling automatic rotation is done via the enable-key-rotation command. Option B is incorrect because AWS managed keys have rotation enabled by default. Option C is incorrect because using a CloudHSM is not necessary. Option D is incorrect because importing a key does not enable rotation.

Answer

Use AWS CloudHSM to generate a new key and rotate manually.

Answer

Replace the key with an AWS managed key.

Answer

Import a key material and enable automatic rotation.

Question 9

A company is using AWS KMS with a customer managed key for encrypting EBS volumes. The security team wants to ensure that only specific IAM roles can use the key for encryption and decryption. What is the best way to achieve this?

Accepted Answer

Attach a resource-based policy (key policy) to the KMS key that allows the specific IAM roles.. Option C is correct because KMS key policies can specify IAM roles (or role ARNs) as principals. Option A is incorrect because IAM policies alone are not sufficient if the key policy does not grant access; key policy must allow IAM policies. Option B is incorrect because attaching a policy to the key directly is the recommended approach. Option D is incorrect because grants are for specific operations, not for broad role-based access.

Answer

Create a KMS grant that allows the roles to use the key.

Answer

Use an SCP to allow only those roles to use the key.

Answer

Use an IAM policy that grants kms:Encrypt and kms:Decrypt to the roles, and ensure the key policy enables IAM policy access.

Question 10

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team needs to ensure that automated backups are also encrypted. How can this be achieved?

Accepted Answer

Enable encryption at rest on the RDS instance; backups are automatically encrypted. Option C is correct because enabling encryption at rest on the RDS instance automatically encrypts backups. Option A is wrong because manual encryption of backups is not required. Option B is wrong because you cannot encrypt backups separately from the instance. Option D is wrong because RDS does not support that feature.

Answer

Manually encrypt each backup using AWS KMS before storing in S3

Answer

Use RDS Copy-on-Write to encrypt backups

Answer

Create an encrypted S3 bucket and store backups there

Question 11

A security engineer needs to ensure that all data in an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must deny any PutObject request that does not include the x-amz-server-side-encryption header with value aws:kms. Which bucket policy element should be used?

Accepted Answer

Deny with condition StringNotEquals for s3:x-amz-server-side-encryption. To enforce encryption, use a bucket policy with a Deny effect on s3:PutObject when the condition aws:SecureTransport or s3:x-amz-server-side-encryption is not set to aws:kms. Option A is correct because it uses a Deny with a condition for the encryption header. Option B is incorrect because Allow with condition does not deny unencrypted requests. Option C is incorrect because NotPrincipal is used for cross-account, not for encryption enforcement. Option D is incorrect because s3:PutObjectAcl is not relevant.

Answer

Deny with NotPrincipal

Answer

Deny on s3:PutObjectAcl

Answer

Allow with condition StringEquals for s3:x-amz-server-side-encryption

Question 12

A company uses AWS KMS to encrypt data in S3. The security policy requires that keys be rotated every 12 months. Which type of KMS key supports automatic rotation?

Accepted Answer

Customer managed keys with automatic rotation enabled. Customer managed keys (CMKs) support optional automatic rotation every year. AWS managed keys rotate automatically every 3 years but cannot be configured. Option B is correct. Option A is incorrect because AWS managed keys rotate every 3 years, not 12 months. Option C is incorrect because custom key store keys do not support automatic rotation. Option D is incorrect because imported key material does not support automatic rotation.

Answer

Imported key material

Answer

Custom key store keys

Answer

AWS managed keys

Question 13

A company needs to securely store database credentials for a legacy application running on Amazon EC2. The credentials are currently hardcoded in the application code. Which service should be used to rotate and retrieve secrets automatically?

Accepted Answer

AWS Secrets Manager.. Option B is correct because AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because SSM Parameter Store does not natively support automatic rotation. Option C is wrong because KMS is for encryption keys, not secrets management. Option D is wrong because CloudHSM is for hardware security modules.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

AWS Key Management Service (KMS).

Answer

AWS CloudHSM.

Question 14

A security engineer applies the above S3 bucket policy. An application tries to upload an object with the header "x-amz-server-side-encryption: AES256". What will happen?

Accepted Answer

The upload fails because the encryption header does not match 'aws:kms'.. Option D is correct. The first statement denies PutObject if the encryption header is not "aws:kms". Since the header is "AES256", it does not equal "aws:kms", so the condition StringNotEquals is true, resulting in a deny. The second statement denies if the header is null; here it is not null, so the second statement does not apply. Thus, the request is denied.

Answer

The upload succeeds because the policy allows SSE-S3.

Answer

The upload succeeds because the object is encrypted.

Answer

The upload fails because the header is missing.

Question 15

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects be encrypted using server-side encryption with customer-provided keys (SSE-C). An application fails when trying to read an object with the error 'The request includes an invalid header.' What is the MOST likely cause?

Accepted Answer

The application did not include the x-amz-server-side-encryption-customer-key header in the GET request.. Option A is correct because SSE-C requires the encryption key to be provided in the request headers; if the key is missing or incorrect, the request fails with an invalid header error. Option B is wrong because SSE-C does not involve KMS keys. Option C is wrong because SSE-C does not require an encryption context. Option D is wrong because SSE-C does not require bucket versioning.

Answer

The application did not specify an encryption context in the request.

Answer

The KMS key used for encryption has been disabled.

Answer

The S3 bucket does not have versioning enabled.

Question 16

A company wants to share an encrypted Amazon Machine Image (AMI) with another AWS account. The AMI uses an EBS snapshot encrypted with a customer managed key in KMS. What is the correct procedure to allow the other account to launch an EC2 instance from this AMI?

Accepted Answer

Share the AMI, share the snapshot, and grant the target account decrypt permissions on the KMS key.. Option A is correct because to share an encrypted AMI, you must share the AMI, the snapshot, and the KMS key with the target account. Option B is incorrect because the target account cannot use its own KMS key to decrypt a snapshot encrypted with a different key. Option C is incorrect because sharing the AMI alone is insufficient. Option D is incorrect because the source account must grant decrypt permissions; the target account does not need to create a snapshot.

Answer

Export the snapshot as an unencrypted snapshot and share it.

Answer

Share the AMI and have the target account create a new KMS key to encrypt the snapshot.

Answer

Share only the AMI; the snapshot permissions are inherited from the AMI.

Question 17

The above CLI output shows the encryption configuration for an S3 bucket. What type of encryption is enabled by default?

Accepted Answer

SSE-S3. Option B is correct because AES256 refers to SSE-S3 encryption. Option A is incorrect because SSE-KMS uses 'aws:kms'. Option C is incorrect because SSE-C is not set by default. Option D is incorrect because client-side encryption is not a server-side feature.

Answer

SSE-C

Answer

Client-side encryption

Answer

SSE-KMS

Question 18

A company is designing a data protection strategy for its Amazon S3 buckets. Which TWO actions can help protect data from accidental deletion or overwrite?

Accepted Answer

Enable MFA Delete on the bucket.. The correct answers are A and C. Option A: MFA Delete adds an extra authentication step to delete objects. Option C: Versioning allows recovery of overwritten or deleted objects. Option B: Cross-Region Replication is for disaster recovery, not deletion protection. Option D: Default encryption protects data at rest, not deletion. Option E: Lifecycle policies can delete objects, not protect them.

Answer

Enable Cross-Region Replication.

Answer

Enable default encryption.

Answer

Set a lifecycle policy to expire objects.

Question 19

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team needs to ensure high availability and durability of the keys. Which architecture should be recommended?

Accepted Answer

Deploy a CloudHSM cluster with at least two HSMs in different Availability Zones. Option B is correct because CloudHSM clusters with multiple HSMs provide high availability and durability. Option A is wrong because a single HSM is a single point of failure. Option C is wrong because CloudHSM is a hardware appliance, not a software service. Option D is wrong because CloudHSM does not automatically replicate to another region.

Answer

Use AWS KMS instead of CloudHSM for better durability

Answer

Deploy a single CloudHSM instance in one Availability Zone

Answer

Deploy CloudHSM in two AWS Regions with automatic replication

Question 20

A company is using AWS CloudHSM to store encryption keys for a custom application. The application needs high availability across two AWS Regions. What is the MOST secure and cost-effective approach to synchronize key material between the HSMs in each Region?

Accepted Answer

Create a backup of the source HSM and restore it to the target HSM in the second region. CloudHSM does not automatically sync key material across clusters. The best practice is to back up the HSM from one Region and restore to the other using the same backup. Option C is correct because backup and restore in the same account provides secure key synchronization. Option A is incorrect because CloudHSM does not support cross-region replication natively. Option B is incorrect because manual key export via API introduces security risks. Option D is incorrect because KMS does not directly integrate with CloudHSM for key sync across regions.

Answer

Use AWS KMS multi-Region keys with custom key store backed by CloudHSM

Answer

Export the key material from the source HSM using the encrypt/decrypt API and import into the target HSM

Answer

Use the AWS CloudHSM client to replicate the key material automatically across regions