SCS-C02 Mock Exam 73 — 25 Questions

Question 1

A security engineer is implementing a data classification policy for an S3 bucket that contains sensitive customer data. The policy requires that all objects be encrypted at rest using AWS KMS and that any attempt to upload an unencrypted object be denied. Which THREE steps should the engineer take to enforce this policy? (Choose THREE.)

Accepted Answer

Create a customer managed KMS key.. Options A, E, and B are correct. Option A: KMS key can be used for server-side encryption. Option E: Bucket policy with condition s3:x-amz-server-side-encryption-aws:kms denies uploads without KMS encryption. Option B: Default encryption ensures objects are encrypted even if no header is provided. Option C is wrong because enforcing SSL does not relate to encryption at rest. Option D is wrong because bucket keys are for performance, not policy enforcement.

Answer

Enable S3 bucket keys to reduce KMS API calls.

Answer

Enable bucket policy to enforce SSL (aws:SecureTransport).

Question 2

A company is using AWS Organizations and wants to restrict the use of specific AWS services in member accounts. Which TWO approaches can be used to enforce these restrictions? (Choose TWO.)

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU).. Options A and B are correct. Option A: SCPs can deny service actions across all accounts in an OU. Option B: IAM policies can restrict users within an account. Option C is wrong because AWS Config only detects noncompliance, does not prevent. Option D is wrong because CloudTrail is for logging. Option E is wrong because Service Quotas does not restrict service usage.

Answer

Use Service Quotas to limit the number of resources per service.

Answer

Enable AWS CloudTrail to log service usage.

Answer

Use AWS Config rules to automatically terminate resources.

Question 3

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to read objects from an S3 bucket only from the office IP range 192.0.2.0/24. However, the user reports that they can access objects from any IP address. What is the most likely reason?

Accepted Answer

The policy does not include an explicit Deny for requests outside the IP range.. Option A is correct because the policy is missing an explicit Deny. The Allow with condition only grants access from the specified IP range, but the default implicit Deny can be overridden by other policies that allow s3:GetObject without conditions. Option B is wrong because S3 bucket policies are separate. Option C is wrong because the resource is correct. Option D is wrong because the condition is correct.

Answer

The condition key is misspelled; it should be aws:SourceIp without the 's'.

Answer

The policy is attached to the user, but the bucket has a bucket policy that allows public access.

Answer

The resource ARN is missing the bucket name.

Question 4

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

Accepted Answer

The command is limiting results to one event.. Option C is correct because the command uses --max-results 1, limiting output to one event. Option A is wrong because the query is for ResourceName. Option B is wrong because the event is shown. Option D is wrong because the console uses the same CloudTrail data.

Answer

The bucket policy changes were made through the AWS Management Console, which is not logged.

Answer

The event is not logged because PutBucketPolicy is not supported by CloudTrail.

Answer

The command is filtering by the wrong attribute.

Question 5

A security engineer is designing a data encryption solution for a multi-region application that uses Amazon S3. The solution must use envelope encryption with a key hierarchy that allows the application to encrypt data locally using a data key, while the data key is protected by a master key stored in AWS KMS. The application should be able to decrypt data even if connectivity to AWS KMS is temporarily lost. Which approach meets these requirements?

Accepted Answer

Use KMS GenerateDataKey to obtain a plaintext data key and encrypted data key. Cache the plaintext key in memory; for decryption, use the cached key. If cache miss, call KMS Decrypt.. Option D is correct because by caching the plaintext data key, the application can decrypt locally without calling KMS. Option A would require KMS for decryption. Option B does not allow decryption without KMS. Option C uses the wrong key type.

Answer

Use the KMS GenerateDataKey API to get a plaintext data key and encrypted data key. Store both; for decryption, call KMS Decrypt to get the plaintext key.

Answer

Use KMS GenerateDataKeyWithoutPlaintext to get only the encrypted data key. Store it; for decryption, call KMS Decrypt.

Answer

Use an AWS managed key to encrypt data directly without a data key.

Question 6

A company has an Amazon S3 bucket with versioning enabled. They want to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). They also want to prevent any future uploads that are not encrypted with SSE-KMS. Which combination of actions should they take?

Accepted Answer

Add a bucket policy that denies s3:PutObject if s3:x-amz-server-side-encryption is not aws:kms. Use S3 Inventory to report encryption status of existing objects.. Option A is correct because a bucket policy denying PutObject without SSE-KMS prevents non-compliant uploads, and S3 Inventory reports encryption status. Option B only checks compliance, does not enforce. Option C does not enforce encryption. Option D does not enforce.

Answer

Use AWS Config rule s3-bucket-server-side-encryption-enabled to check compliance.

Answer

Use S3 Object Lock with governance mode.

Answer

Enable default encryption with SSE-KMS on the bucket. Use S3 Inventory to report encryption status.

Question 7

A security engineer applies the bucket policy shown in the exhibit to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows uploads only if they use SSE-KMS.. Option B is correct because the second statement denies uploads if the SSE header is null, meaning no encryption specified. Combined with the first statement, only SSE-KMS uploads are allowed. Option A is incorrect because the policy denies non-KMS and no-encryption. Option C is incorrect because it denies both. Option D is incorrect because it allows SSE-S3? No, it denies.

Answer

Allows uploads only if they use SSE-S3.

Answer

Allows uploads without encryption.

Answer

Allows uploads with any server-side encryption.

Question 8

A company stores sensitive data in an Amazon S3 bucket. The security team requires that all data in transit between the company's on-premises data center and S3 be encrypted. Which solution meets this requirement?

Accepted Answer

Use HTTPS (TLS) endpoints when uploading objects to S3.. Option B is correct because using HTTPS (TLS) encrypts data in transit between the client and S3. Option A is wrong because S3 does not support IPsec VPN directly for object uploads. Option C is wrong because VPC endpoints encrypt traffic within AWS, but not the on-premises connection. Option D is wrong because S3 Transfer Acceleration speeds up transfers but does not provide encryption; HTTPS is still needed.

Answer

Set up an IPsec VPN connection between the data center and AWS, and access S3 through the VPN.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use AWS PrivateLink to create a VPC endpoint for S3.

Question 9

A company's security policy requires that all data stored in Amazon S3 be encrypted using envelope encryption with a key hierarchy. The master key must be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated. Which solution should the company implement?

Accepted Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.. Option C is correct because AWS KMS uses envelope encryption and supports custom key stores backed by CloudHSM, which is FIPS 140-2 Level 3 validated. Option A is wrong because KMS default key store uses FIPS 140-2 Level 2 validated HSMs. Option B is wrong because CloudHSM alone does not provide envelope encryption; you would need to implement it yourself. Option D is wrong because S3 does not have a built-in envelope encryption feature.

Answer

Use AWS KMS with the default KMS key store.

Answer

Use Amazon S3 with SSE-S3 and enable default encryption.

Answer

Use AWS CloudHSM to generate a master key and implement envelope encryption in the application.

Question 10

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They must manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys and manage rotation. SSE-S3 uses AWS-managed keys (no customer control). SSE-KMS uses KMS keys but AWS manages rotation unless using customer-managed keys with automatic rotation. Option C is correct because SSE-C gives full control over key management and rotation.

Answer

SSE-S3

Answer

SSE-KMS with AWS managed key

Answer

Client-side encryption

Question 11

A company stores sensitive data in Amazon S3 and requires that objects are automatically encrypted using server-side encryption with AWS KMS. The bucket policy must deny any PUT request that does not include the x-amz-server-side-encryption header with value aws:kms. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The condition key s3:x-amz-server-side-encryption can be used to check the header value. Condition key aws:SourceIp is for source IP; aws:RequestedRegion is for region; kms:EncryptionContext is for KMS encryption context. Option A is correct.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

kms:EncryptionContext

Question 12

A security engineer runs the command shown in the exhibit. What is the primary purpose of this command?

Accepted Answer

To encrypt the contents of secret.txt using a KMS key and store the result in encrypted_secret.txt.. Option B is correct because the command uses KMS to encrypt the contents of secret.txt and writes the base64-decoded ciphertext to a file. Option A is about decrypting. Option C is about generating a data key. Option D is about re-encrypting.

Answer

To generate a data key without plaintext.

Answer

To re-encrypt an existing encrypted file under a new key.

Answer

To decrypt the file secret.txt using a KMS key.

Question 13

A company is migrating sensitive data to Amazon S3. The data must be encrypted at rest using keys managed by the company. The company also requires an audit trail of key usage. Which solution meets these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed key and enable CloudTrail for KMS.. Option B is correct because AWS KMS with a customer-managed key provides encryption at rest and integrates with AWS CloudTrail to log every use of the key. Option A is wrong because SSE-S3 uses Amazon-managed keys; no customer control or audit. Option C is wrong because SSE-C does not provide key usage auditing. Option D is wrong because CloudHSM can be used but requires more effort for audit; KMS is simpler.

Answer

Use SSE-S3 with default encryption.

Answer

Use SSE-C and store the keys in AWS Secrets Manager.

Answer

Use AWS CloudHSM to generate and store keys, and use Amazon S3 with SSE-KMS.

Question 14

A company uses AWS KMS to encrypt data in Amazon S3. They need to audit all KMS key usage for an S3 bucket. Which AWS service should be used to capture KMS Decrypt API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures API calls to AWS services, including KMS Decrypt. CloudTrail logs can be delivered to S3 for analysis. Option C is correct. CloudWatch Logs can receive logs but does not directly capture KMS API calls; S3 server access logs do not include KMS decryption events; VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon S3 server access logs

Answer

Amazon VPC Flow Logs

Answer

AWS CloudWatch Logs

Question 15

A company stores sensitive customer data in Amazon S3. They want to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which S3 bucket policy statement should be added to deny uploads that do not request SSE-KMS?

Accepted Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'aws:kms'. Option A is correct because the condition 's3:x-amz-server-side-encryption' with 'aws:SecureTransport' is not the right condition. Option B uses 's3:x-amz-server-side-encryption-aws-kms-key-id' which is too specific. Option C is the correct standard policy to deny PutObject without SSE-KMS. Option D is wrong because it requires a specific KMS key ID, not just any KMS key.

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'AES256'

Answer

Deny PutObject unless 'aws:SourceArn' equals the bucket ARN

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption-aws-kms-key-id' is present

Question 16

A company is designing a data protection strategy for Amazon EBS volumes. Which THREE practices should be implemented? (Choose THREE.)

Accepted Answer

Enable encryption by default for new EBS volumes. Options A, B, and C are correct for EBS data protection. Option D is for S3. Option E is for RDS.

Answer

Use S3 Object Lock to prevent deletion of snapshots

Answer

Enable automated backups for Amazon RDS

Question 17

A company stores sensitive data in Amazon S3. The security team needs to ensure that data is encrypted at rest and that access is logged. Which TWO actions meet these requirements?

Accepted Answer

Enable S3 server access logs. Option A (Enable default encryption on the bucket) and Option D (Enable S3 server access logs) are correct. Default encryption ensures data is encrypted at rest. Server access logs record requests to the bucket. Option B is wrong because CloudTrail is for API calls, not data events by default. Option C is wrong because VPC Flow Logs capture network traffic, not S3 access. Option E is wrong because IAM Access Analyzer is for analyzing resource policies, not logging access.

Answer

Enable VPC Flow Logs for the VPC

Answer

Enable AWS CloudTrail to log data events

Answer

Enable AWS IAM Access Analyzer

Question 18

A security engineer is designing a data protection strategy for a healthcare application that stores Protected Health Information (PHI) in an S3 bucket. The bucket is accessed by multiple AWS services, including Athena and SageMaker. Which TWO actions should the engineer take to ensure encryption at rest and in transit? (Choose two.)

Accepted Answer

Enable S3 bucket default encryption using AES-256.. Option A is wrong because while default encryption provides at-rest encryption, it does not enforce encryption in transit. Option B is correct because a bucket policy that denies requests without HTTPS ensures encryption in transit. Option C is correct because enabling bucket default encryption with SSE-S3 or SSE-KMS ensures encryption at rest. Option D (CloudHSM) is not necessary for S3 encryption and adds complexity. Option E is wrong because Kinesis Data Firehose is not directly relevant to S3 encryption.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Use AWS CloudHSM to generate and store encryption keys for S3.

Answer

Set up Kinesis Data Firehose to encrypt data before writing to S3.

Question 19

A company needs to encrypt data at rest in Amazon S3 using customer-provided encryption keys. The keys must be stored securely and rotated automatically every 90 days. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with a customer-managed key (CMK) and enable automatic key rotation.. Option C is correct because AWS KMS with customer-managed keys (CMK) allows automatic key rotation every 90 days (or yearly if managed by KMS). Option A is wrong because SSE-S3 uses Amazon-managed keys with automatic rotation of 90 days, but the keys are not customer-provided. Option B is wrong because SSE-C requires customers to provide keys but does not offer automatic rotation. Option D is wrong because CloudHSM requires manual key rotation.

Answer

Use SSE-C and upload new keys to S3 every 90 days.

Answer

Use SSE-S3 and enable automatic key rotation in the S3 bucket properties.

Answer

Use AWS CloudHSM and generate a new key every 90 days via a custom script.

Question 20

A company is designing a data protection strategy for Amazon EFS file systems. The security team requires encryption at rest and in transit. Additionally, the team needs to control which KMS keys can be used to encrypt the file system. Which THREE steps should the team take?

Accepted Answer

Configure a KMS key policy that allows the EFS service to use the key.. Option A is correct because EFS supports encryption at rest using a KMS key. Option B is correct because enabling encryption of data in transit using TLS is a separate setting. Option D is correct because a KMS key policy can restrict which keys can be used for EFS. Option C is wrong because EFS does not support SSE-S3. Option E is wrong because IAM policies for users can restrict KMS actions, but key policy is more direct.

Answer

Enable default encryption on the EFS file system using SSE-S3.

Answer

Use an IAM policy to restrict which users can create encrypted file systems.