SCS-C02 Mock Exam 76 — 25 Questions

Question 1

A company uses Amazon EBS volumes for EC2 instances. The security team requires that all EBS volumes be encrypted at rest. The team creates an AWS Config rule to check whether EBS volumes are encrypted. However, some volumes are non-compliant even though they have encryption enabled. What is the most likely reason?

Accepted Answer

The volumes are not encrypted at the time of creation, even though encryption is enabled later.. Option D is correct because the AWS Config managed rule 'encrypted-volumes' checks if EBS volumes are encrypted, but it does not check the default encryption setting for the account; it only checks the volumes themselves. Option A is wrong because Config rules check the configuration, not the encryption key. Option B is wrong because the rule checks volumes, not snapshots. Option C is wrong because the rule does not check encryption keys.

Answer

The volumes were created from unencrypted snapshots.

Answer

The volumes are encrypted with a different KMS key than the one specified in the Config rule.

Answer

The Config rule is configured to check for a specific KMS key alias.

Question 2

A company wants to protect sensitive data stored in Amazon S3 by encrypting it at rest. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS KMS is the service for managing encryption keys. Option A is wrong because S3-managed keys (SSE-S3) are managed by AWS, not the customer. Option B is wrong because AWS CloudHSM provides hardware security modules but is not a key management service. Option D is wrong because AWS Secrets Manager is for secrets, not encryption keys.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS S3-managed keys (SSE-S3)

Question 3

Which TWO of the following are best practices for protecting data in transit? (Choose TWO.)

Accepted Answer

Enforce HTTPS for web traffic. Using TLS and enforcing HTTPS are best practices. Option B is wrong because encryption at rest does not protect in transit. Option C is wrong because VPN is not always needed. Option E is wrong because HTTP is not secure.

Answer

Use a VPN for all traffic

Answer

Use HTTP for internal traffic

Answer

Use encryption at rest

Question 4

A company uses AWS Secrets Manager to store database credentials. The security team needs to ensure that secrets are automatically rotated every 30 days. The rotation function must be implemented with minimal operational overhead. Which approach should be used?

Accepted Answer

Enable automatic rotation in Secrets Manager and configure the rotation interval to 30 days. Option B is correct because Secrets Manager provides built-in rotation support for supported services like RDS, with automatic trigger via Lambda. Option A is wrong because EventBridge rules are not needed; Secrets Manager handles scheduling. Option C is wrong because manual rotation using CLI defeats automation. Option D is wrong because CloudWatch Events is not needed; rotation is managed internally.

Answer

Create an Amazon EventBridge rule that triggers a Lambda function to rotate the secret

Answer

Use AWS CLI to schedule a cron job that runs every 30 days and rotates the secret

Answer

Use Amazon CloudWatch Events to invoke an AWS Lambda function that updates the secret

Question 5

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation fails with an error indicating that the secret cannot be accessed. What is the most likely cause?

Accepted Answer

The Lambda rotation function lacks IAM permissions to update the secret. Option C is correct because the Lambda function needs permissions to read the secret and update the database. Option A is not about rotation. Option B would cause an unrelated error. Option D is about encryption key permissions, but the error is about accessing the secret.

Answer

The KMS key used to encrypt the secret is disabled

Answer

The secret is not encrypted

Answer

The secret is not in the same region as the database

Question 6

A company uses AWS KMS to encrypt data in Amazon S3. Security team wants to ensure that only specific IAM roles can decrypt objects. Which KMS key policy configuration should be used?

Accepted Answer

In the key policy, use a Condition block with kms:ViaService set to s3.<region>.amazonaws.com and allow kms:Decrypt for the role.. Option C is correct because using kms:ViaService condition restricts key usage to requests coming from S3, and the IAM role's permissions to decrypt are granted via the key policy, not just IAM policy. Option A is wrong because without the key policy granting decrypt, the IAM policy alone is insufficient. Option B is wrong because it grants blanket access to the role without the S3 service restriction. Option D is wrong because it doesn't restrict to a specific role.

Answer

Attach an IAM policy to the role that allows kms:Decrypt, and leave the KMS key policy with default settings.

Answer

In the key policy, use a Principal element specifying the role ARN, and allow kms:Decrypt.

Answer

Use a grant for the role to allow kms:Decrypt for S3 operations.

Question 7

A company needs to implement data protection for Amazon EFS file systems. Which TWO features should be configured?

Accepted Answer

Enable encryption in transit using TLS.. Option B is correct because EFS supports encryption at rest using KMS. Option D is correct because encryption in transit can be enforced using a mount option. Option A is wrong because EFS does not support versioning. Option C is wrong because EFS does not have Block Public Access; it uses security groups. Option E is wrong because EFS does not use lifecycle policies for data protection; they manage storage tiers.

Answer

Configure EFS Block Public Access.

Answer

Enable EFS versioning.

Answer

Configure EFS lifecycle management to transition files to Infrequent Access.

Question 8

A company wants to protect sensitive data stored in Amazon S3. Which TWO actions should the company take to meet this goal? (Choose TWO.)

Accepted Answer

Enable S3 Block Public Access.. Options B and D are correct. Option B: Enabling default encryption ensures that new objects are automatically encrypted. Option D: Using S3 Block Public Access prevents accidental public exposure. Option A is wrong because S3 Transfer Acceleration is for speed, not security. Option C is wrong because S3 event notifications are for automation, not protection. Option E is wrong because S3 Object Lock prevents deletion/modification, not unauthorized access.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure S3 event notifications to send events to Amazon SNS.

Answer

Enable S3 Object Lock.

Question 9

A company uses AWS KMS with a customer managed key to encrypt an S3 bucket. The security team notices that the KMS key is being used by an unintended IAM role. What is the MOST effective way to restrict the key usage to only the intended role?

Accepted Answer

Modify the key policy to allow only the intended role and deny all others. Using a KMS key policy with a condition on kms:CallerArn is the most effective. Option A is wrong because the key policy already exists and you cannot remove the default key policy. Option B is wrong because the original key policy may have allowed broad access. Option D is wrong because S3 bucket policy does not control KMS key usage.

Answer

Remove the default key policy and attach an IAM policy to the intended role

Answer

Use an S3 bucket policy to restrict access to the intended role

Answer

Create a new KMS key and attach a new key policy

Question 10

A company wants to protect data stored in Amazon S3 by encrypting it at rest using keys managed by the company. Which encryption option should be used?

Accepted Answer

SSE-C. Option B is correct because SSE-C allows the customer to provide and manage their own encryption keys. Option A is wrong because SSE-S3 uses AWS-managed keys. Option C is wrong because SSE-KMS uses AWS KMS managed keys. Option D is wrong because client-side encryption is not an S3 server-side encryption option.

Answer

SSE-KMS

Answer

Client-side encryption

Answer

SSE-S3

Question 11

Refer to the exhibit. A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All objects must be encrypted with SSE-S3. Option B is correct. The policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256, thus enforcing SSE-S3 encryption on all uploads. Option A is wrong because it does not enforce SSE-KMS. Option C is wrong because the condition checks for AES256, not for the absence of encryption. Option D is wrong because the policy denies unencrypted uploads, not allows them.

Answer

The policy has no effect because the condition is invalid

Answer

Objects without encryption headers are allowed

Answer

All objects must be encrypted with SSE-KMS

Question 12

A company needs to protect sensitive data in Amazon S3 from accidental deletion or overwriting. The data must be retained for at least 7 years after creation. Which combination of S3 features should be used?

Accepted Answer

Enable S3 Object Lock in Governance mode and configure a lifecycle policy to expire objects after 7 years. Option D is correct because Object Lock with Governance mode prevents deletion, and lifecycle policies can expire objects after 7 years. Option A only prevents deletion, not overwriting. Option B only protects against accidental deletion. Option C only manages storage classes.

Answer

Enable S3 Versioning and enable S3 Object Lock in Compliance mode

Answer

Use S3 Intelligent-Tiering and lifecycle policies

Answer

Enable S3 Versioning and MFA Delete

Question 13

A company is designing a disaster recovery plan for its Amazon RDS for MySQL database. The database must be encrypted at rest. Which approach ensures that the database is encrypted and can be restored in another AWS Region?

Accepted Answer

Create a cross-Region read replica with encryption enabled. Option C (Use a cross-Region read replica with encryption enabled) is correct because it replicates data to another Region and encryption can be enabled. Option A is wrong because enabling encryption on an existing unencrypted DB instance is not supported. Option B is wrong because a snapshot copy with encryption can be restored but does not provide continuous replication. Option D is wrong because S3 is not used for RDS backups directly.

Answer

Enable encryption on the existing DB instance

Answer

Export the database to Amazon S3 and use S3 cross-Region replication

Answer

Create a manual snapshot and copy it to another Region with encryption

Question 14

A company uses Amazon RDS for MySQL with encryption at rest enabled using AWS KMS. They need to ensure that automated backups and snapshots are also encrypted. Which configuration is required?

Accepted Answer

No additional configuration is needed; backups are encrypted automatically.. Option C is correct because RDS automatically encrypts snapshots and backups when the source database is encrypted. No additional steps are needed. Option A is wrong because encryption is already inherited. Option B is wrong because the same KMS key is used by default. Option D is wrong because enabling encryption on a non-encrypted instance requires a snapshot copy with encryption.

Answer

Manually encrypt each snapshot with a separate KMS key.

Answer

Create a new KMS key and assign it to the backup configuration.

Answer

Enable encryption on the RDS instance after creation.

Question 15

A company is migrating on-premises databases to Amazon RDS for MySQL. The security team requires that data be encrypted at rest and in transit. Which combination of steps should the team take to meet these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance and set the rds.force_ssl parameter to 1 in the DB parameter group.. Option D is correct because enabling encryption at rest on the RDS instance (which can be done during creation or via snapshot) and requiring SSL for connections (by setting the rds.force_ssl parameter to 1) meets both requirements. Option A is wrong because enabling encryption at rest alone does not cover in-transit. Option B is wrong because using a client-side encryption library is not a standard RDS feature. Option C is wrong because using an RDS proxy with TLS does not enforce SSL for direct connections.

Answer

Use an RDS proxy with TLS termination and enable encryption at rest.

Answer

Enable encryption at rest on the RDS instance and use a client-side encryption library.

Answer

Enable encryption at rest and configure the security group to allow only HTTPS traffic.

Question 16

A company is designing a data protection strategy for Amazon S3. The compliance team requires that all objects be encrypted at rest and that any attempt to upload an unencrypted object be blocked. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Enable default encryption on the bucket with SSE-S3 or SSE-KMS.. Options A, B, and D are correct. Option A: Enabling default encryption ensures objects are encrypted at rest. Option B: Using a bucket policy to deny PutObject without encryption header blocks unencrypted uploads. Option D: Using S3 Block Public Access prevents public exposure. Option C is wrong because S3 Transfer Acceleration does not encrypt data. Option E is wrong because S3 Object Lock does not enforce encryption.

Answer

Enable S3 Object Lock.

Answer

Enable S3 Transfer Acceleration.

Question 17

A company wants to ensure that data stored in Amazon EBS volumes is encrypted at rest. What is the easiest way to achieve this?

Accepted Answer

Enable EBS encryption by default in the AWS Region. Enable EBS encryption by default for the AWS Region. Option B is wrong because individual volume encryption can be done, but default is easier. Option C is wrong because encryption at the application layer is not necessary. Option D is wrong because KMS key rotation does not enable encryption.

Answer

Use AWS KMS to rotate the EBS encryption key

Answer

Use a script to encrypt each volume after creation

Answer

Use application-level encryption

Question 18

A company wants to protect sensitive data in Amazon S3 by ensuring that all objects are encrypted at rest. Which TWO options meet this requirement? (Choose TWO.)

Accepted Answer

Use server-side encryption with S3 managed keys (SSE-S3). Options A and C are correct encryption methods provided by S3. Option B is for client-side, but not S3's own encryption. Option D is for data in transit. Option E is for masking, not encryption.

Answer

Use SSL/TLS for data in transit

Answer

Use client-side encryption with the AWS Encryption SDK

Answer

Use Amazon Macie to classify and mask data

Question 19

A company uses Amazon EBS volumes for EC2 instances. Security policy requires that all EBS volumes be encrypted at rest. The company already has a default KMS key for EBS encryption. However, some new volumes are created without encryption. What is the most efficient way to enforce encryption for all new EBS volumes?

Accepted Answer

Enable EBS encryption by default in the EC2 console or via the API. Option B (Set the EBS encryption by default flag at the account level) is correct because it forces all new volumes to be encrypted using the default KMS key. Option A is wrong because it requires manual intervention. Option C is wrong because it requires creating a custom volume type. Option D is wrong because CloudWatch alarms are reactive, not preventive.

Answer

Use AWS CloudTrail to monitor volume creation and send alerts

Answer

Create an AWS Config rule to detect unencrypted volumes and trigger a Lambda function to encrypt them

Answer

Use a custom AMI that enforces encryption

Question 20

A company is designing a data protection solution for Amazon S3 that must prevent any user from accidentally deleting objects. Which combination of S3 features should be used?

Accepted Answer

Enable S3 Versioning and MFA Delete.. Option A is correct because MFA Delete adds an extra factor for deletions, and versioning allows recovery of deleted objects. Option B is wrong because Object Lock prevents overwrites/deletion only if retention period is set, but doesn't prevent deletion of the bucket. Option C is wrong because replication doesn't protect against deletion. Option D is wrong because default encryption doesn't prevent deletion.

Answer

Use S3 Cross-Region Replication to another bucket.

Answer

Enable S3 Object Lock with governance mode.

Answer

Configure S3 default encryption with SSE-KMS.