SCS-C02 Mock Exam 75 — 25 Questions

Question 1

A company has an S3 bucket that stores financial records. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted with a specific AWS KMS key. The team creates a bucket policy that denies s3:PutObject unless the request includes the correct encryption header. However, some users who upload objects using the AWS Management Console report that their uploads fail. What is the most likely cause?

Accepted Answer

The console uses multipart uploads, which require encryption headers on each part.. Option A is correct because the AWS Management Console uses multipart uploads for large objects, and multipart uploads require the encryption header to be specified in each part upload. Option B is wrong because the bucket policy can enforce encryption; a KMS key policy is separate. Option C is wrong because S3 Transfer Acceleration does not affect encryption. Option D is wrong because the console respects bucket policies.

Answer

The KMS key policy does not allow the s3:PutObject operation.

Answer

The console does not support server-side encryption.

Answer

S3 Transfer Acceleration is enabled, which bypasses the bucket policy.

Question 2

Refer to the exhibit. A security engineer configures the above KMS key policy. The DataAccess role is used by an application that runs on EC2 instances in the us-east-1 region. The application needs to read encrypted objects from an S3 bucket in the same region. Which of the following is true about this configuration?

Accepted Answer

The role can decrypt objects in S3, but cannot use the key outside of S3.. Option A is correct. The condition 'kms:ViaService' restricts the use of the key to requests that originate from S3 in us-east-1. This means the role can only use the key when the request comes through S3 (e.g., S3 GetObject with SSE-KMS). Option B is wrong because the role can still encrypt data via S3 PutObject (GenerateDataKey). Option C is wrong because the condition allows usage via S3. Option D is wrong because the role does not have kms:Encrypt but has kms:GenerateDataKey, which is sufficient for S3 PutObject.

Answer

The role can use the key for any S3 operation in any region.

Answer

The role cannot use the key for any operation because the condition is invalid.

Answer

The role can only encrypt data, not decrypt it.

Question 3

A company is using AWS KMS to encrypt data in Amazon S3. The security team discovers that an S3 bucket has a bucket policy that allows s3:PutObject without requiring encryption. What is the risk?

Accepted Answer

Data can be uploaded without encryption at rest. Data can be uploaded without encryption, potentially exposing sensitive data. Option A is wrong because the data is not encrypted at rest. Option C is wrong because encryption in transit is not related. Option D is wrong because the risk is about data being stored unencrypted.

Answer

The KMS key can be used by unauthorized users

Answer

Data can be downloaded without authentication

Answer

Data in transit is not encrypted

Question 4

A company needs to encrypt data at rest for an Amazon RDS for Oracle database. The database is deployed in a Multi-AZ configuration. The company also wants to encrypt automated backups and snapshots. Which TWO steps should the security team take?

Accepted Answer

Enable encryption at rest when launching the RDS instance.. Option A is correct because encryption must be enabled at launch; it cannot be added later. Option C is correct because enabling encryption at rest automatically encrypts backups and snapshots. Option B is wrong because encryption cannot be enabled on an existing unencrypted instance. Option D is wrong because encryption must be enabled at launch, not after. Option E is wrong because KMS key must be specified at launch; can be changed later only for certain engines.

Answer

Modify the DB instance to enable encryption after creation.

Answer

Enable encryption at rest on the existing RDS instance via a modification.

Answer

Specify a KMS key after the instance is launched.

Question 5

A company wants to protect data in transit between an on-premises data center and AWS over the internet. Which AWS service should they use to create a dedicated, encrypted connection?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN provides an encrypted tunnel over the internet between on-premises and AWS. AWS Direct Connect provides a dedicated connection but is not encrypted by default; IPsec can be added. AWS Transit Gateway is a network transit hub, not a connection type. AWS Client VPN is for individual clients. Option B is correct.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Answer

AWS Client VPN

Question 6

A financial services company is designing a data protection strategy for its DynamoDB table containing sensitive customer data. The table has a global secondary index (GSI). The company needs to encrypt the data at rest using a customer managed key (CMK) that is rotated annually. Which solution meets these requirements?

Accepted Answer

Create the table with a customer managed key (CMK) and enable automatic key rotation. DynamoDB supports encryption at rest using AWS KMS. When a table is created, you can specify a CMK. The GSI inherits the encryption settings from the base table. Option D is correct because you can specify a CMK at table creation and enable automatic key rotation. Option A is incorrect because you cannot change the encryption key after table creation without recreating the table. Option B is incorrect because using an AWS managed key does not allow customer-controlled rotation. Option C is incorrect because enabling encryption on the GSI separately is not supported; encryption is inherited from the table.

Answer

Create the table with default encryption, then update the table to use a CMK and enable automatic rotation

Answer

Create the table without encryption, then enable encryption on the table and GSI separately using a CMK

Answer

Create the table with an AWS managed key and use AWS KMS automatic rotation

Question 7

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. A developer attempts to upload an object with the header x-amz-server-side-encryption: AES256. What will happen?

Accepted Answer

The upload fails with an AccessDenied error.. The policy denies PutObject if the encryption header is not equal to 'aws:kms'. Since the developer uses AES256, the condition StringNotEquals evaluates to true, so the Deny applies. Upload fails. Option B is correct. Option A is wrong because AES256 is not allowed. Option C is wrong because the request is denied. Option D is wrong because there is no policy that allows only SSE-KMS; the Deny applies.

Answer

The upload succeeds because the policy only denies unencrypted uploads.

Answer

The upload succeeds because the policy allows all encryption methods.

Answer

The upload succeeds because the object is encrypted with AES256.

Question 8

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type meets this requirement?

Accepted Answer

AWS managed key (aws/s3). AWS managed keys (aws/s3) are automatically rotated every year. Customer managed keys (CMKs) can be rotated manually or automatically, but the question specifies automatic rotation. Option B is correct because AWS managed keys are automatically rotated. Option A is incorrect because customer managed keys require manual rotation or enabling automatic rotation. Option C is incorrect because imported key material does not support automatic rotation. Option D is incorrect because asymmetric keys are not automatically rotated.

Answer

Customer managed key with manual rotation

Answer

Asymmetric customer managed key

Answer

Imported key material in a customer managed key

Question 9

A company needs to encrypt data at rest in its Amazon EBS volumes. The company wants to use an encryption key that is automatically rotated every year without any manual intervention. Which key type should be used?

Accepted Answer

AWS managed key for EBS. AWS managed keys are automatically rotated annually. Customer managed keys can have automatic rotation enabled, but the question implies a managed solution. Option B is correct. Option A is incorrect because customer managed keys require enabling automatic rotation. Option C is incorrect because imported keys do not support automatic rotation. Option D is incorrect because the default EBS encryption uses an AWS managed key, but the question asks for the key type.

Answer

Imported key material in a customer managed key

Answer

Customer managed key with manual rotation

Answer

Default EBS encryption using an AWS managed key

Question 10

A company stores sensitive customer data in Amazon S3. To comply with data protection regulations, they need to automatically prevent any new objects from being made publicly accessible. Which S3 feature should they configure?

Accepted Answer

Enable S3 Block Public Access at the account level.. Option B is correct because S3 Block Public Access settings at the account or bucket level can enforce that no new objects or ACLs grant public access. Option A is wrong because bucket policies can be circumvented if not enforced; Block Public Access is a preventative guardrail. Option C is wrong because Object Lock prevents deletion/overwrite but doesn't control public access. Option D is wrong because default encryption only encrypts data at rest.

Answer

Configure a bucket policy that denies s3:PutObject with a condition for public access.

Answer

Use S3 default encryption with SSE-S3.

Answer

Enable S3 Object Lock in governance mode.

Question 11

A company uses Amazon Redshift with encryption at rest using AWS KMS. They want to ensure that automated snapshots are encrypted with the same key and that cross-account snapshot sharing is secured. Which THREE steps should be taken?

Accepted Answer

Enable encryption on the Redshift cluster at creation time.. Option A is correct because Redshift automatically encrypts snapshots if the cluster is encrypted. Option C is correct because to share snapshots cross-account, the KMS key must allow the target account to decrypt. Option D is correct because Redshift uses a snapshot copy grant to authorize the destination account to use the key. Option B is wrong because separate key is not required; same key can be used if permissions allow. Option E is wrong because AWS Config rule doesn't enforce cross-account sharing security.

Answer

Create a new KMS key for snapshot encryption to isolate from the cluster key.

Answer

Enable AWS Config rule to detect unencrypted snapshots.

Question 12

A company stores data in Amazon S3 and uses AWS KMS with Customer Master Keys (CMKs) for encryption. The security team wants to audit when the CMK is used to decrypt data. Which of the following will provide this information?

Accepted Answer

AWS CloudTrail. Option D is correct because AWS CloudTrail logs all KMS Decrypt API calls. Option A is wrong because S3 server access logs record requests to S3, not the KMS decryption calls. Option B is wrong because CloudWatch Logs can store logs but does not generate them. Option C is wrong because AWS Config records configuration changes, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

S3 server access logs

Question 13

A company wants to protect sensitive data stored in Amazon S3 by enforcing encryption in transit. Which policy should be used to deny requests that do not use HTTPS?

Accepted Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*", "Condition": {"Bool": {"aws:SecureTransport": "false"}}}. A bucket policy with a condition on aws:SecureTransport denies non-HTTPS requests. Option A is wrong because it refers to encryption at rest. Option C is wrong because it denies all requests. Option D is wrong because it denies HTTPS traffic, which is the opposite.

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*", "Condition": {"Bool": {"aws:SecureTransport": "true"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*", "Condition": {"Null": {"s3:x-amz-server-side-encryption": "true"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*"}

Question 14

Which TWO of the following are valid methods to enforce encryption at rest for an Amazon RDS for PostgreSQL DB instance? (Choose 2.)

Accepted Answer

Restore a DB instance from an encrypted snapshot. Options B and D are correct. You can only enable encryption at creation time or by restoring from an encrypted snapshot. Option A is wrong because you cannot encrypt an existing unencrypted instance. Option C is wrong because enabling encryption on a snapshot is not supported; you must copy it. Option E is wrong because read replicas inherit encryption settings from the source.

Answer

Enable encryption on an existing unencrypted DB instance

Answer

Take a snapshot of the unencrypted instance and enable encryption on the snapshot

Answer

Create an encrypted read replica and promote it

Question 15

A company wants to encrypt data in transit between an on-premises data center and AWS over a VPN connection. Which AWS service or feature should be used?

Accepted Answer

AWS Site-to-Site VPN. Option A is correct because AWS Site-to-Site VPN provides encrypted tunnels. Option B is for domain registration. Option C is for managing SSL certificates. Option D is for API gateway.

Answer

AWS Route 53 Resolver

Answer

AWS Certificate Manager (ACM)

Answer

Amazon API Gateway

Question 16

A company is using Amazon S3 to store backup files that must be retained for 7 years. The files are accessed infrequently but must be available within minutes when needed. The company wants to minimize storage costs while ensuring data is encrypted at rest. Which storage class and encryption combination is most cost-effective?

Accepted Answer

S3 Glacier Instant Retrieval with SSE-S3. S3 Glacier Deep Archive is the lowest-cost storage class for long-term retention but has retrieval times of 12 hours, which does not meet the 'minutes' requirement. S3 Glacier Instant Retrieval provides milliseconds retrieval and is cost-effective for infrequent access. Option B is correct. SSE-S3 provides encryption at no additional cost. Options A and C have longer retrieval times. Option D is more expensive.

Answer

S3 Glacier Deep Archive with SSE-S3

Answer

S3 Glacier Flexible Retrieval with SSE-KMS

Answer

S3 Standard-IA with SSE-KMS

Question 17

A company is designing a data protection strategy for its Amazon RDS for MySQL database. The database contains sensitive data that must be encrypted at rest. The company also needs to manage the encryption keys using its own HSM. Which solution should be used?

Accepted Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM. RDS supports encryption at rest using KMS. To use a customer-managed HSM, you can use AWS CloudHSM with a custom key store in KMS. Option C is correct. Option A is incorrect because RDS does not directly integrate with CloudHSM. Option B is incorrect because the default key is AWS managed. Option D is incorrect because RDS does not support client-side encryption for at-rest data.

Answer

Use client-side encryption with a key from CloudHSM

Answer

Use AWS CloudHSM to generate a key and import it into RDS

Answer

Enable encryption at rest using the default AWS KMS key

Question 18

Refer to the exhibit. A security engineer is reviewing the CloudWatch Logs configuration for a Lambda function. The log group is encrypted with a customer managed key. The engineer needs to ensure that only the Lambda service can write logs to this log group and that only a specific IAM role can read logs. Which additional configuration is required?

Accepted Answer

Add a condition to the KMS key policy that uses kms:ViaService to restrict encryption/decryption to logs.amazonaws.com and a condition that the Lambda function is the source. CloudWatch Logs uses a service-linked role to write logs. To restrict writing to the Lambda service, you need to add a condition to the key policy that allows the logs service only when the request comes from Lambda. Option C is correct. Option A is incorrect because a bucket policy is for S3. Option B is incorrect because resource-based policies on log groups are for cross-account access, not to restrict write access. Option D is incorrect because IAM roles cannot be assigned to log groups.

Answer

Attach a resource-based policy to the log group that allows only the Lambda service to write logs

Answer

Create an S3 bucket policy to allow only Lambda to write to the log group

Answer

Assign an IAM role to the log group that has permission to write logs

Question 19

A company needs to protect data at rest on Amazon EBS volumes attached to EC2 instances. Which solution provides the most control over the encryption keys?

Accepted Answer

Use a customer managed KMS key with EBS encryption.. Option A is correct because using a customer managed KMS key allows the customer to control key rotation, policies, and access. Option B is wrong because AWS managed keys do not allow customer control. Option C is wrong because EBS encryption by default uses AWS managed keys unless specified. Option D is wrong because client-side encryption would require application changes.

Answer

Encrypt data using client-side encryption before writing to EBS.

Answer

Use an AWS managed KMS key for EBS encryption.

Answer

Enable EBS encryption by default in the account.

Question 20

A company is using AWS KMS to encrypt data in Amazon S3. They need to ensure that the KMS key can only be used from within a specific VPC. Which TWO actions should be taken?

Accepted Answer

Create a VPC endpoint for AWS KMS.. Option A is correct because a VPC endpoint for KMS is needed to access KMS privately. Option D is correct because a key policy condition using kms:SourceVpc restricts usage to the VPC. Option B is wrong because bucket policy cannot restrict KMS key usage. Option C is wrong because IAM policy alone cannot restrict based on VPC for KMS; it's the key policy. Option E is wrong because a VPC endpoint for S3 does not restrict KMS calls.

Answer

Attach an IAM policy to the role that denies kms:Decrypt unless the request comes from the VPC.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Add a bucket policy condition to restrict access to the VPC.