SCS-C02 Practice Exam 66 — 20 Questions

Question 1

Refer to the exhibit. A security engineer reviews the key policy of an AWS KMS customer managed key. The AppRole role is used by an application to encrypt and decrypt data. However, the application is unable to decrypt data. What is the MOST likely cause?

Accepted Answer

The KMS key is disabled.. Option B is correct because the 'Allow use of the key' statement grants Encrypt, Decrypt, ReEncrypt*, GenerateDataKey*, and DescribeKey actions, which should allow decryption. However, the issue might be that the key is disabled or the application is not using the correct key. The exhibit shows the key policy allows the actions; if decryption fails, the key might be disabled. Option A is wrong because the policy includes kms:Decrypt. Option C is wrong because the Admin role has key administration permissions, but that doesn't affect decryption by AppRole. Option D is wrong because the root principal is allowed full access, so that's not an issue.

Answer

The root user does not have permission to use the key.

Answer

The key administrator has not granted the AppRole permission to use the key.

Answer

The kms:Decrypt permission is not granted to the AppRole.

Question 2

A company wants to protect sensitive data stored in S3 from being accessed by unauthorized users. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use IAM policies to restrict access to the bucket.. Options A and C are correct. S3 Block Public Access prevents public access, and IAM policies control access at the user/role level. Option B is incorrect because encryption does not prevent access; it protects data if accessed. Option D is incorrect because MFA Delete is for deletion protection, not access control. Option E is incorrect because Versioning does not control access.

Answer

Enable S3 Versioning.

Answer

Enable default encryption on all S3 buckets.

Answer

Enable MFA Delete on the bucket.

Question 3

A company is designing a data encryption solution for its Amazon RDS for PostgreSQL database. The database must be encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Enable encryption when creating the RDS instance using a KMS key.. Option A is correct because RDS supports encryption at rest for new databases using AWS KMS. Option B is incorrect because there is no separate encryption layer; RDS uses KMS. Option C is incorrect because application-level encryption is not the simplest. Option D is incorrect because RDS does not support CloudHSM for encryption at rest.

Answer

Enable AWS KMS encryption on the RDS instance after creation.

Answer

Use application-level encryption before inserting data into the database.

Answer

Use AWS CloudHSM to encrypt the EBS volumes attached to the RDS instance.

Question 4

A company wants to ensure that all data transferred between its on-premises data center and AWS is encrypted in transit. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS Site-to-Site VPN. Option B is correct because AWS Site-to-Site VPN encrypts traffic between on-premises and AWS. Option A is wrong because Direct Connect does not encrypt by default. Option C is wrong because CloudFront is for content delivery. Option D is wrong because Transit Gateway is a network transit hub, not encryption.

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 5

A security engineer is reviewing a KMS key policy. What does this policy accomplish?

Accepted Answer

Allow the SecurityAudit role to decrypt and re-encrypt data only from the same AWS account. Option B is correct because the policy allows the SecurityAudit role to decrypt and re-encrypt only from the same account. Option A is wrong because it does allow decrypt and re-encrypt. Option C is wrong because the condition restricts to the same account. Option D is wrong because the policy doesn't restrict key usage to specific resources.

Answer

Deny decryption to the SecurityAudit role

Answer

Allow the SecurityAudit role to use the key only for specific KMS keys

Answer

Allow any user from account 123456789012 to use the key

Question 6

A security engineer needs to audit all access to a KMS customer managed key. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS API calls. Option B is correct. Option A is incorrect because CloudWatch Logs can store logs but does not generate them. Option C is incorrect because AWS Config tracks resource configuration, not API calls. Option D is incorrect because VPC Flow Logs capture network traffic, not KMS operations.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 7

A security engineer inspects two KMS keys. Which key can be used for envelope encryption with automatic key rotation?

Accepted Answer

Key 1234abcd-12ab-34cd-56ef-1234567890ab.. Option A is correct because key 1234abcd has KeyRotationEnabled: true and is a customer-managed key (KeyManager: CUSTOMER) which supports automatic rotation. Key 2345bcde is AWS managed (KeyManager: AWS) but rotation is not enabled. However, AWS managed keys do not support automatic rotation. Therefore, the only key that can have rotation enabled is key 1234abcd.

Answer

Key 2345bcde-23bc-45de-67fg-2345678901bc.

Answer

Neither key supports envelope encryption with automatic rotation.

Answer

Both keys support envelope encryption with automatic rotation.

Question 8

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its targets. Which configuration should be used?

Accepted Answer

Configure the ALB with an HTTPS listener and use HTTPS as the protocol for the target group.. Option B is correct because HTTPS listeners on the ALB can terminate TLS and optionally re-encrypt traffic to targets using HTTPS. Option A is wrong because HTTP does not encrypt data. Option C is wrong because TCP listeners do not provide encryption. Option D is wrong because the security group does not control encryption.

Answer

Configure the ALB with a TCP listener and use Network Load Balancer.

Answer

Configure the ALB security group to allow only encrypted traffic.

Answer

Configure the ALB with an HTTP listener and use a security group to enforce encryption.

Question 9

A company needs to protect data stored in S3 from accidental deletion by users. Which S3 feature should be used?

Accepted Answer

S3 Versioning. Option B is correct because S3 Versioning allows retrieval of overwritten or deleted objects. Option A is incorrect because MFA Delete protects against deletion but is not the primary protection against accidental deletion. Option C is incorrect because S3 Block Public Access prevents public access, not deletion. Option D is incorrect because S3 Lifecycle policies manage storage classes, not deletion protection.

Answer

S3 Lifecycle policies

Answer

S3 MFA Delete

Answer

S3 Block Public Access

Question 10

A company stores sensitive customer data in an S3 bucket. The security team wants to ensure that all data is encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Which bucket policy statement should be added to deny uploads that do not use SSE-KMS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. Option A is correct because it uses the 's3:x-amz-server-side-encryption' condition key set to 'aws:kms' to enforce SSE-KMS, and the 'Null' condition for the encryption key to require that a KMS key is specified. Options B, C, and D use incorrect condition keys or values.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*"}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Question 11

A company is using AWS Key Management Service (KMS) with a customer managed key. The security team needs to ensure that the key can be rotated automatically every year. Which TWO steps are required?

Accepted Answer

Enable automatic key rotation in the KMS console or API.. The correct answers are A and C. Option A: Automatic key rotation can be enabled on the KMS key. Option C: The key must be a customer managed key because automatic rotation is not available for AWS managed keys. Option B: IAM permissions are not required for rotation. Option D: Imported key material cannot be automatically rotated. Option E: CloudTrail logging is not a prerequisite for rotation.

Answer

Enable AWS CloudTrail for the KMS key.

Answer

Ensure the key material is generated by AWS KMS, not imported.

Answer

Grant the KMS service principal permission to rotate the key.

Question 12

A company is designing a data lake on Amazon S3 and needs to encrypt data at rest. The compliance team requires that the encryption keys be managed by the company and not by AWS. Which encryption option should be used?

Accepted Answer

SSE-C. Option C is correct because SSE-C allows the customer to provide their own encryption keys. Option A is wrong because SSE-S3 keys are managed by AWS. Option B is wrong because SSE-KMS keys are managed by AWS. Option D is wrong because client-side encryption involves more overhead and is not server-side.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 13

A security engineer is designing a data protection strategy for an S3 bucket that contains sensitive documents. The bucket is accessed by multiple IAM users and roles. Which TWO actions will help protect the data at rest and in transit?

Accepted Answer

Add a bucket policy that denies requests without aws:SecureTransport. Options A and C are correct. Enabling default encryption (A) ensures data at rest is encrypted. Enforcing HTTPS (C) protects data in transit. Option B is incorrect because MFA delete does not protect data in transit or at rest. Option D is incorrect because S3 Access Logs are for auditing, not protection. Option E is incorrect because pre-signed URLs still use HTTPS if enforced, but they do not protect data at rest.

Answer

Enable S3 Access Logs and send them to a separate account

Answer

Enable MFA Delete on the S3 bucket

Answer

Use pre-signed URLs for all access

Question 14

A company uses AWS KMS to encrypt data at rest in Amazon RDS for MySQL. The security team needs to ensure that the RDS instance can only be decrypted by a specific IAM role used by the production application, and not by any other IAM user or role. What is the most secure way to achieve this?

Accepted Answer

Modify the KMS key policy to allow 'kms:Decrypt' only for the production role and deny for all other principals.. Option B is correct because using a KMS key policy that grants decrypt permission only to the production role ensures that only that role can decrypt the RDS instance. Option A is wrong because IAM policies alone cannot restrict decryption if the key policy allows broader access. Option C is wrong because RDS does not support attaching IAM roles at the instance level for this purpose. Option D is wrong because it makes the key accessible to all users.

Answer

Enable key rotation and use a custom key store to isolate the key.

Answer

Create an IAM policy that denies 'kms:Decrypt' to all principals except the production role, and attach it to the key.

Answer

Attach the production IAM role to the RDS instance and use a condition in the IAM role's policy to allow decrypt.

Question 15

A company is storing sensitive data in Amazon S3. They want to ensure that all data is encrypted at rest using server-side encryption. Which THREE options are available for server-side encryption in S3? (Select THREE.)

Accepted Answer

SSE-KMS. Options A, B, and C are correct. SSE-S3, SSE-KMS, and SSE-C are the three server-side encryption options. Option D is wrong because client-side encryption is not server-side. Option E is wrong because AWS CloudHSM is a service for hardware security modules, not an S3 encryption option.

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 16

A company is designing a data protection strategy for sensitive data stored in Amazon S3. Compliance requirements mandate that all data be encrypted at rest using customer-provided keys (SSE-C). Which solution meets the requirements with minimal operational overhead?

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager.. Option B is correct because S3 server-side encryption with customer-provided keys (SSE-C) allows the customer to manage encryption keys while AWS handles encryption/decryption, meeting compliance with minimal overhead. Option A is wrong because using KMS with a customer-managed key (SSE-KMS) is not SSE-C. Option C is wrong because client-side encryption requires managing keys outside AWS, increasing overhead. Option D is wrong because SSE-S3 uses AWS-managed keys, not customer-provided.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3) and enable bucket versioning.

Answer

Use client-side encryption with the AWS Encryption SDK and store keys in the application configuration.

Answer

Use server-side encryption with AWS KMS managed keys (SSE-KMS) and enable automatic key rotation.

Question 17

Which THREE practices are recommended for managing encryption keys in AWS KMS? (Choose 3.)

Accepted Answer

Enable automatic rotation of the KMS key annually.. Options B, C, and D are correct. B: Enabling automatic key rotation annually is a best practice. C: Using key policies to control access follows least privilege. D: Using CloudTrail to audit KMS API calls provides visibility. Option A is wrong because sharing the key material defeats the purpose of KMS. Option E is wrong because deleting a key immediately can cause data loss; it should be scheduled for deletion.

Answer

Delete the KMS key immediately when it is no longer needed.

Answer

Export the KMS key material and store it in a secure S3 bucket.

Question 18

A company is using AWS DMS to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The data must be encrypted in transit. What should the company do?

Accepted Answer

Enable SSL on the source and target endpoints in the DMS task.. Option D is correct because DMS supports SSL/TLS for encrypting data in transit between endpoints. Option A is incorrect because VPN is not required; DMS supports SSL directly. Option B is incorrect because KMS encrypts at rest, not in transit. Option C is incorrect because Direct Connect provides a private network but does not inherently encrypt traffic; SSL is still needed.

Answer

Use AWS Direct Connect to establish a private connection.

Answer

Use AWS KMS to encrypt the data before sending.

Answer

Set up a VPN connection between the on-premises network and AWS VPC.

Question 19

A company uses AWS CloudHSM to generate and store encryption keys for a custom database. The security team needs to back up the keys to another AWS Region for disaster recovery. What is the most secure and efficient way to achieve this?

Accepted Answer

Create a backup of the source CloudHSM cluster and copy the backup to the destination Region.. Option C is correct because CloudHSM supports copying backups across regions using the AWS CLI or console, which is secure and efficient. Option A is incorrect because exporting keys directly is not supported; backups are used. Option B is incorrect because manual copy (e.g., scp) is not supported. Option D is incorrect because cross-region replication does not apply to CloudHSM backups.

Answer

Export the keys from the source CloudHSM cluster and import them into a destination cluster in the other Region.

Answer

Enable cross-Region replication on the CloudHSM cluster.

Answer

Use the key_mgmt_util command-line tool to copy the keys to an on-premises HSM, then upload to the destination Region.

Question 20

A company is storing sensitive customer data in Amazon S3. The security team requires that all data be encrypted at rest using a key that is rotated automatically every year. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use SSE-S3. Option D is correct because SSE-S3 uses Amazon S3-managed keys that are automatically rotated. Option A is wrong because SSE-KMS requires manual key rotation or enabling automatic key rotation. Option B is wrong because client-side encryption adds operational overhead. Option C is wrong because SSE-C requires the customer to manage keys.

Answer

Use SSE-C with an AWS-managed key

Answer

Use SSE-KMS with automatic key rotation

Answer

Use client-side encryption with a custom key