SCS-C02 Practice Exam 65 — 20 Questions

Question 1

A company uses Amazon S3 to store sensitive documents. They must ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which S3 bucket policy statement achieves this?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256 AND the encryption is SSE-S3.. Option B is correct because it denies PutObject if the request does not include the x-amz-server-side-encryption header with value AES256. Option A is wrong because it only denies if the header is missing, but allows other values. Option C is wrong because it allows only AES256 but does not deny unencrypted. Option D is wrong because it denies all PutObject requests.

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256.

Answer

Deny s3:PutObject for all principals.

Answer

Allow s3:PutObject only when x-amz-server-side-encryption: AES256 is present.

Question 2

A company has an S3 bucket with versioning and MFA Delete enabled. A user attempts to delete an object version using the AWS CLI without MFA. What will happen?

Accepted Answer

The request fails with an AccessDenied error.. Option C is correct. With MFA Delete enabled, deleting an object version requires MFA in the request. Since the user did not provide MFA, the request will be denied with an AccessDenied error. Option A is wrong because the object version is not deleted. Option B is wrong because the object version is not marked for deletion. Option D is wrong because lifecycle rules do not apply to manual delete requests.

Answer

The object version is marked for deletion and will be deleted after 30 days.

Answer

The object version is deleted and a delete marker is created.

Answer

The object version is deleted but not permanently.

Question 3

Which TWO actions can help protect data at rest in Amazon EBS volumes? (Choose 2.)

Accepted Answer

Enable EBS encryption by default in the AWS Account settings.. Options A and C are correct. A: Enabling EBS encryption by default ensures new volumes are encrypted. C: Using EBS encryption with KMS encrypts the volume at rest. Option B is wrong because data on EBS is not automatically encrypted; the OS must be configured. Option D is wrong because EBS snapshots are not automatically encrypted; they can be encrypted during copy. Option E is wrong because EBS encryption is independent of instance type.

Answer

Enable automatic encryption of EBS snapshots by default.

Answer

Use an instance type that supports encryption at rest.

Answer

Configure the operating system to use encrypted file systems.

Question 4

A security team wants to audit who accessed an S3 object that contains sensitive data. Which AWS service provides this capability?

Accepted Answer

S3 Server Access Logs. Option A is correct because S3 Server Access Logs provide detailed records about requests. Option B is incorrect because CloudTrail logs API calls but not object-level access unless Data Events are enabled. Option C is incorrect because AWS Config tracks resource configuration, not access. Option D is incorrect because CloudWatch Logs can store logs but does not generate them by default.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 5

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that KMS keys are rotated automatically every year. Which action should be taken?

Accepted Answer

Enable automatic key rotation on the customer managed key.. Option B is correct because AWS KMS supports automatic key rotation for customer managed keys (CMKs) when enabled. Option A is incorrect because automatic rotation is available for CMKs, not just AWS managed keys. Option C is incorrect because manual rotation is not required. Option D is incorrect because rotation is independent of CloudTrail.

Answer

Create a new key and update the alias to point to the new key every year.

Answer

Enable automatic key rotation on the AWS managed key.

Answer

Use an AWS CloudTrail event to trigger a Lambda function that rotates the key.

Question 6

A company needs to protect data in transit between an on-premises data center and AWS. Which THREE services can be used to encrypt data in transit?

Accepted Answer

HTTPS. The correct answers are A, C, and E. Option A: TLS certificates encrypt data in transit. Option C: IPsec VPN encrypts network traffic. Option E: HTTPS encrypts web traffic. Option B: AWS KMS manages encryption keys, not transit. Option D: AWS Shield protects against DDoS attacks, not data encryption.

Answer

AWS Key Management Service (KMS)

Answer

AWS Shield

Question 7

A company is implementing a data protection strategy for Amazon S3. Which TWO actions should be taken to protect data from accidental deletion or overwrite?

Accepted Answer

Enable MFA Delete on the bucket. Options B and D are correct. Enable versioning to preserve previous versions, and enable MFA Delete to require multi-factor authentication for deletions. Option A is wrong because bucket policies alone do not prevent deletion. Option C is wrong because encryption does not prevent deletion. Option E is wrong because replication does not protect against deletion in the source bucket.

Answer

Enable cross-region replication

Answer

Apply a bucket policy that denies s3:DeleteObject

Answer

Enable default encryption on the bucket

Question 8

A company is migrating a legacy application to AWS. The application stores sensitive data and must comply with PCI DSS. The security team needs to ensure that data is encrypted at rest using keys that are rotated every 12 months. Which THREE steps should the team take?

Accepted Answer

Enable AWS CloudTrail to log all KMS key usage. Options A, C, and D are correct. Using AWS KMS with automatic annual rotation (A) meets the requirement. Ensuring the application uses envelope encryption (C) is a best practice. Configuring CloudTrail (D) provides audit trail for key usage. Option B is incorrect because CloudHSM requires manual key rotation. Option E is incorrect because SSE-C3 is not a valid encryption type; SSE-C uses customer-provided keys, which do not rotate automatically.

Answer

Use AWS CloudHSM to generate and store keys, and manually rotate them every 12 months

Answer

Use S3 bucket policy to enforce SSE-C3 encryption

Question 9

A company is using Amazon S3 to store sensitive customer data. They need to ensure that data is encrypted at rest and that the encryption keys are managed by the company, not AWS. Which S3 encryption option should they use?

Accepted Answer

SSE-C. Option C is correct because SSE-C allows the customer to provide their own encryption keys and manage them. Option A is wrong because SSE-S3 uses AWS-managed keys. Option B is wrong because SSE-KMS uses AWS-managed KMS keys. Option D is wrong because client-side encryption is not an S3 server-side encryption option.

Answer

Client-side encryption

Answer

SSE-KMS

Answer

SSE-S3

Question 10

A company has a requirement to automatically rotate encryption keys for Amazon EBS volumes every 90 days. The EBS volumes are encrypted using AWS KMS. What is the simplest way to meet this requirement?

Accepted Answer

Create a new KMS key every 90 days and re-encrypt volumes using a script.. Option B is correct because automatic key rotation in KMS rotates the backing key annually, but for 90-day rotation you must create a new key and update volumes. Option A is wrong because KMS automatic rotation is yearly. Option C is wrong because manual rotation by creating a new key and updating volumes is required. Option D is wrong because you cannot change key on existing volumes without snapshot/restore.

Answer

Use AWS Secrets Manager to rotate the KMS key automatically.

Answer

Switch to client-side encryption and rotate keys manually.

Answer

Enable automatic key rotation on the existing KMS key.

Question 11

A security engineer needs to ensure that data at rest in an Amazon RDS for PostgreSQL DB instance is encrypted. Which action should the engineer take?

Accepted Answer

Create a new DB instance with encryption enabled using the AWS CLI or Console.. Option A is correct because RDS encryption at rest is enabled by specifying the --storage-encrypted flag during creation. Option B is wrong because encryption can only be enabled at creation time; existing unencrypted instances cannot be encrypted without migration. Option C is wrong because encryption at rest is not enabled by default. Option D is wrong because encryption at rest is independent of KMS key permissions.

Answer

Grant the rds:ModifyDBInstance permission to allow encryption toggling.

Answer

Modify the existing unencrypted DB instance to enable encryption.

Answer

Enable encryption automatically by enabling automated backups.

Question 12

Which TWO methods can be used to encrypt data at rest in Amazon S3? (Choose 2.)

Accepted Answer

Use SSE-S3 to have Amazon S3 manage the encryption keys.. Options A and D are correct. A: Server-side encryption with S3 managed keys (SSE-S3) encrypts data at rest. D: Client-side encryption using the AWS Encryption SDK encrypts data before uploading. Option B is wrong because S3 does not support encrypting data in transit at rest; encryption in transit is handled by HTTPS. Option C is wrong because bucket policies do not encrypt data. Option E is wrong because MFA Delete protects against accidental deletion, not encryption.

Answer

Set a bucket policy that denies uploads without encryption.

Answer

Enable encryption in transit using HTTPS.

Answer

Enable MFA Delete on the S3 bucket.

Question 13

A company wants to ensure that data at rest in Amazon EBS volumes is encrypted. What is the simplest way to achieve this?

Accepted Answer

Enable EBS encryption by default in the AWS account.. Option B is correct because enabling EBS encryption by default in the account encrypts all new volumes. Option A is incorrect because each volume does not need manual encryption. Option C is incorrect because encryption is not applied at the OS level. Option D is incorrect because KMS is used for key management, but the simplest is to enable default encryption.

Answer

Use AWS KMS to create a custom key and attach it to each volume.

Answer

Encrypt each volume manually using the AWS Management Console.

Answer

Use an operating system-level encryption tool like LUKS.

Question 14

An application running on Amazon EC2 needs to access an S3 bucket containing sensitive data. The security team wants to avoid storing long-term AWS credentials on the instance. How should the EC2 instance be configured to access S3 securely?

Accepted Answer

Assign an IAM role with S3 permissions to the EC2 instance via an instance profile.. Option A is correct because using an IAM role with an instance profile is the recommended method to grant EC2 instances temporary credentials. Option B is incorrect because storing access keys on the instance is insecure. Option C is incorrect because S3 pre-signed URLs are for granting temporary access to specific objects, not for general instance access. Option D is incorrect because EC2 does not support KMS key-based direct access to S3.

Answer

Store IAM user access keys in the instance's user data.

Answer

Attach a KMS key policy that allows the instance to decrypt S3 objects.

Answer

Generate S3 pre-signed URLs for all objects the instance needs to access.

Question 15

A company uses AWS KMS to encrypt data in Amazon RDS. The security team discovers that a developer accidentally deleted a customer master key (CMK) used for RDS encryption. What is the impact on the RDS instances that were encrypted with that key?

Accepted Answer

The RDS instances will become inaccessible and data will be lost. Option C is correct because deleting a KMS key renders encrypted RDS instances unrecoverable. Option A is wrong because the data is permanently inaccessible. Option B is wrong because you cannot simply re-encrypt without the original key. Option D is wrong because the key deletion is not automatically reversible after the scheduled deletion period.

Answer

The key deletion can be reversed within 30 days

Answer

The RDS instances will be automatically re-encrypted with a new key

Answer

The RDS instances will continue to operate normally

Question 16

A company wants to protect sensitive data in Amazon S3 from unauthorized access. Which TWO AWS services can be used to detect and alert on suspicious access patterns?

Accepted Answer

AWS CloudTrail. Options A and C are correct. Amazon Macie uses machine learning to discover and protect sensitive data, and AWS CloudTrail logs API calls for monitoring. Option B is wrong because GuardDuty is for threat detection across accounts, not specifically for S3 data access. Option D is wrong because Config is for compliance. Option E is wrong because CloudWatch Logs can store logs but not analyze access patterns without additional services.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 17

A company wants to protect data in transit between an EC2 instance and an S3 bucket. Which method should be used?

Accepted Answer

Use HTTPS endpoints for S3 API calls. Using HTTPS (TLS) encrypts data in transit. Option C is correct. Option A is incorrect because SSL certificates are for web servers. Option B is incorrect because IPsec is for site-to-site VPN. Option D is incorrect because SSH is for remote administration.

Answer

Use a VPN connection with IPsec

Answer

Install an SSL certificate on the EC2 instance

Answer

Use SSH to transfer files

Question 18

A company uses AWS KMS to encrypt EBS volumes attached to EC2 instances. The security team wants to ensure that when an EC2 instance is terminated, the associated EBS volume is automatically deleted and the data is unrecoverable. However, the team also needs to retain the volume's data for 90 days for compliance purposes. What is the most secure and cost-effective approach?

Accepted Answer

Before termination, create a snapshot of the volume, copy the snapshot encrypted with a new KMS key, then delete the volume and the original snapshot after 90 days.. Option D is correct because taking a snapshot of the volume before deletion, encrypting it with a different KMS key, and then deleting the volume ensures the data is retained for 90 days and the original volume is unrecoverable. Option A is wrong because disabling the key does not prevent data recovery if a snapshot exists. Option B is wrong because lifecycle manager does not handle deletion. Option C is wrong because it does not preserve data.

Answer

Use Amazon Data Lifecycle Manager to create a snapshot and delete the volume after termination.

Answer

Disable the KMS key used to encrypt the volume, then terminate the instance.

Answer

Configure the EC2 instance with 'DeleteOnTermination' attribute set to true and enable termination protection.

Question 19

A company uses AWS CloudTrail to log API activity. The security team wants to ensure that log files are encrypted at rest and that any tampering with logs is detectable. Which combination of services should be used?

Accepted Answer

Enable CloudTrail log file SSE-KMS encryption and enable CloudTrail log file integrity validation.. Option C is correct because CloudTrail can be configured to use SSE-KMS for encryption, and log file integrity validation provides tamper detection. Option A is wrong because CloudWatch Logs does not provide integrity validation. Option B is wrong because S3 server access logs are not for CloudTrail. Option D is wrong because CloudHSM does not integrate directly with CloudTrail.

Answer

Enable CloudTrail and configure S3 bucket to use default encryption and enable S3 server access logs.

Answer

Use AWS CloudHSM to generate keys and encrypt CloudTrail logs at the application layer.

Answer

Enable CloudTrail log file encryption using SSE-S3 and store logs in CloudWatch Logs.

Question 20

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to enforce that all S3 PUT requests include an encryption context that matches a specific key-value pair. Which S3 bucket policy condition key should be used?

Accepted Answer

kms:EncryptionContextKeys. Option C is correct because kms:EncryptionContextKeys is the condition key that allows you to require a specific encryption context in KMS operations. Option A is wrong because s3:x-amz-server-side-encryption is for requiring SSE. Option B is wrong because kms:ViaService is for restricting KMS usage to a specific AWS service. Option D is wrong because s3:PutObjectEncryption is not a valid condition key.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

s3:PutObjectEncryption