SCS-C02 Data Protection — 40 Questions

Question 1

A company stores sensitive data in Amazon S3 and wants to ensure that all objects are encrypted at rest. The security team has enabled default encryption on the S3 bucket using SSE-S3. However, an audit reveals that some objects are stored with SSE-KMS. How can the company enforce that only SSE-S3 is used for all future uploads, while still allowing existing SSE-KMS objects to be read?

Accepted Answer

Apply a bucket policy that denies s3:PutObject unless the x-amz-server-side-encryption header is AES256.. Option C is correct because it uses a bucket policy to deny s3:PutObject unless the x-amz-server-side-encryption header is set to AES256, which is the value for SSE-S3. This enforces that all future uploads use SSE-S3, while existing SSE-KMS objects remain readable because the policy only applies to write operations. The condition key s3:x-amz-server-side-encryption checks the encryption header value, and the Deny effect overrides any Allow, ensuring compliance.

Answer

Configure a bucket policy that denies s3:PutObject with s3:x-amz-server-side-encryption-aws:kms.

Answer

Use an S3 Lifecycle policy to transition existing SSE-KMS objects to SSE-S3.

Answer

Disable SSE-KMS in the AWS KMS key policy to prevent its use.

Question 2

A financial services company uses AWS KMS to encrypt sensitive data. The security team has a requirement to rotate the CMK every 90 days and to maintain a record of all previous key versions for decryption of historical data. The team creates a new CMK every 90 days and manually updates applications to use the new key. This process is error-prone and causes downtime. What is the MOST operationally efficient solution that meets the requirements?

Accepted Answer

Create a new CMK every 90 days and update the alias to point to the new key. Applications reference the alias.. Option B is correct because it uses aliases to decouple the key identifier from the application configuration. By creating a new CMK every 90 days and updating the alias to point to the new key, applications that reference the alias automatically use the new key without code changes, eliminating downtime. AWS KMS aliases are mutable pointers that can be reassigned to different CMKs, and the old key versions remain available for decryption of historical data.

Answer

Enable automatic key rotation on the existing CMK.

Answer

Use a CMK with imported key material and rotate the material every 90 days.

Answer

Continue creating new CMKs but use a script to update the application configuration files.

Question 3

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

Accepted Answer

Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.. AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.

Answer

Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.

Answer

Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.

Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.

Question 4

A company is designing a data protection strategy for its Amazon S3 bucket that stores sensitive documents. The security team requires that all data be encrypted in transit and at rest, and that any accidental deletion of objects can be reversed within 30 days. Additionally, the company must be able to audit all access attempts to the bucket, including failed attempts. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Enable AWS CloudTrail with data events for S3.. AWS CloudTrail with data events for S3 is correct because it captures all S3 API calls, including GetObject, PutObject, and DeleteObject, and records both successful and failed access attempts. This meets the auditing requirement for all access attempts, including failed ones, as CloudTrail logs the request details, error codes, and source IP addresses.

Answer

Enable default encryption on the bucket using SSE-S3.

Answer

Enable S3 server access logs and send them to a separate bucket.

Answer

Enable MFA Delete on the bucket.

Question 5

A healthcare company runs a HIPAA-compliant application on AWS. The application uses Amazon S3 to store Protected Health Information (PHI). The company has implemented the following controls: (1) All S3 buckets are configured with default encryption using SSE-S3. (2) Bucket policies restrict access to only authorized IAM roles. (3) S3 access logs are enabled and sent to a centralized logging account. (4) MFA Delete is enabled on all buckets. (5) Object lock is not enabled. Recently, an internal auditor discovered that when an authorized user deletes an object, the object is permanently deleted and cannot be recovered. The company's data retention policy requires that deleted PHI be recoverable for at least 30 days after deletion. A review of the IAM policies shows that users have s3:DeleteObject permission. The auditor also notes that the bucket versioning is not enabled. The security team needs to implement a solution that allows authorized users to delete objects but ensures that deleted objects can be recovered within 30 days. Which of the following is the MOST effective course of action?

Accepted Answer

Enable S3 Versioning on the buckets and ensure that the IAM policies include s3:DeleteObjectVersion where appropriate.. Enabling S3 Versioning is the most effective solution because it preserves all object versions, including deleted objects (which become delete markers). With versioning enabled, authorized users can still use s3:DeleteObject to delete the current version, but the previous versions remain recoverable. Since the requirement is to recover deleted PHI within 30 days, versioning combined with a lifecycle policy to permanently delete old versions after 30 days would meet the retention policy without blocking immediate deletion.

Answer

Enable S3 Object Lock in Governance mode with a retention period of 30 days.

Answer

Remove the s3:DeleteObject permission from all IAM policies and use S3 Lifecycle policies to expire objects after 30 days.

Answer

Change the default encryption from SSE-S3 to SSE-C and use a separate key for each object.

Question 6

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which solution meets this requirement?

Accepted Answer

Use a customer managed key and enable automatic rotation with a yearly rotation period.. Option C is correct because customer managed keys (CMKs) in AWS KMS support automatic rotation with a customizable rotation period, which can be set to 365 days (one year) to meet the security team's requirement. AWS managed keys, on the other hand, have a fixed automatic rotation period of every three years (1095 days) and cannot be adjusted, making them unsuitable for a yearly rotation mandate. By using a CMK with automatic rotation enabled and specifying a rotation period of one year, the company ensures that the encryption key material is rotated annually without manual intervention.

Answer

Use an AWS managed key and enable automatic rotation.

Answer

Use a customer managed key with imported key material and enable automatic rotation.

Answer

Use an AWS managed key and manually rotate it every year.

Question 7

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Configure the target group to use HTTPS protocol.. Option A is correct because configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Use a network load balancer instead of an ALB.

Answer

Assign a certificate from ACM to the ALB listener.

Question 8

Refer to the exhibit. An AWS KMS key policy includes the statement shown. The AdminRole tries to decrypt a ciphertext that was encrypted using the same KMS key with encryption context 'department=engineering'. What will happen?

Accepted Answer

The decrypt operation fails because the encryption context does not match the condition.. Option D is correct because the KMS key policy includes a condition that requires the encryption context to match 'department=engineering'. When the AdminRole attempts to decrypt the ciphertext, the encryption context used during decryption must exactly match the context used during encryption. Since the policy enforces this condition with a kms:EncryptionContextKeys condition key, the decrypt operation fails if the context does not match, even though the role has kms:Decrypt permission.

Answer

The decrypt operation succeeds because the role has kms:Decrypt permission.

Answer

The decrypt operation succeeds because the encryption context is ignored during decryption.

Answer

The decrypt operation fails because the policy does not allow kms:Decrypt without matching context.

Question 9

Drag and drop the steps to configure a VPC with private subnets and NAT gateway for outbound internet access in the correct order.

Question 10

Match each AWS security-related acronym to its definition.

Question 11

A company uses S3 to store sensitive customer data. The security team requires that all objects uploaded to S3 be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). A developer reports that some objects are being stored unencrypted. What is the MOST effective way to enforce this requirement?

Accepted Answer

Use a bucket policy to deny s3:PutObject if encryption is not set to aws:kms. Option D is correct because an S3 bucket policy with a Deny condition for s3:PutObject without the x-amz-server-side-encryption header set to aws:kms will block unencrypted uploads. Option A is wrong because SSE-C uses customer-provided keys, not KMS. Option B is wrong because bucket policies are more direct than service control policies for this. Option C is wrong because default encryption only applies when no encryption is specified, but a PUT request can still override it.

Answer

Enable default encryption on the bucket using SSE-S3

Answer

Use an SCP to deny s3:PutObject without encryption

Answer

Set a bucket policy to require the x-amz-server-side-encryption header

Question 12

A company wants to protect data at rest for an Amazon RDS for PostgreSQL database. Which AWS service should be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). Amazon RDS for PostgreSQL integrates with AWS Key Management Service (KMS) to enable encryption at rest. When you enable encryption for an RDS DB instance, KMS manages the customer master keys (CMKs) that encrypt the data keys used by the storage layer. This is the standard, fully managed key management service for RDS encryption, supporting automatic key rotation and fine-grained access control.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 13

A company has a requirement to automatically rotate encryption keys for S3 objects every 90 days. They are using SSE-KMS with a customer managed key. Which combination of actions will meet the requirement without breaking access to existing objects? (Choose two.)

Accepted Answer

Use S3 Batch Operations to re-encrypt existing objects with the new key. Options A and D are correct because enabling automatic key rotation in KMS rotates the key material annually (but not 90 days), and re-encrypting existing objects with the new key ensures they are encrypted with the latest key. Option B is incorrect because deleting the old key breaks access. Option C is incorrect because S3 does not automatically re-encrypt. Option E is incorrect because manual rotation every 90 days is not necessary if automatic rotation is enabled, and re-encryption is needed.

Answer

Configure an S3 lifecycle policy to re-encrypt objects

Answer

Manually rotate the key every 90 days and re-encrypt all objects

Answer

Delete the existing key and create a new one each 90 days

Question 14

A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that when an EC2 instance is launched, the attached EBS volumes are always encrypted using a specific customer managed key. Which action will enforce this?

Accepted Answer

Use a service control policy (SCP) to deny ec2:RunInstances if the volume encryption key is not the required key. Option D is correct because an SCP can deny ec2:RunInstances if the volume encryption key is not the required key. Option A is wrong because IAM roles do not enforce encryption at launch. Option B is wrong because KMS key policies control who can use the key, not which key is used. Option C is wrong because default encryption uses the account's default key, not necessarily the required key.

Answer

Create an IAM role that requires the ec2:RunInstances action to include the kms:KeyId condition

Answer

Configure the KMS key policy to allow only the specific key for EBS encryption

Answer

Enable encryption by default for EBS volumes in the account

Question 15

A company stores sensitive data in an S3 bucket with versioning enabled. They want to ensure that objects are encrypted at rest using SSE-KMS. A security audit reveals that some older object versions are encrypted with SSE-S3. What is the MOST efficient way to re-encrypt those older versions with SSE-KMS?

Accepted Answer

Use S3 Batch Operations to copy objects with SSE-KMS encryption. Option A is correct because S3 Batch Operations can copy objects in place, preserving versions and applying new encryption. Option B is wrong because lifecycle policies do not re-encrypt. Option C is wrong because S3 sync does not handle versioning. Option D is wrong because the S3 console does not have a bulk re-encrypt feature for versions.

Answer

Create a lifecycle policy to transition objects to a new storage class

Answer

Use the AWS CLI s3 sync command with the --sse aws:kms option

Answer

Manually re-upload the objects via the S3 console

Question 16

A company needs to ensure that data in transit between an on-premises data center and Amazon S3 is encrypted. Which AWS service should be used to establish a dedicated encrypted connection?

Accepted Answer

AWS Direct Connect with VPN. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, but it does not inherently encrypt data in transit. By combining Direct Connect with a VPN (IPsec tunnel), you get both a dedicated connection and encryption of all traffic between the on-premises network and Amazon S3. This ensures data in transit is protected while avoiding the public internet.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 17

A company is designing a data protection strategy for an Amazon RDS for MySQL database. The database is 2 TB in size and stores financial data. The compliance team requires that database snapshots be encrypted at rest and that encryption keys be rotated every year. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable automatic key rotation in AWS KMS for the KMS key used for RDS encryption. Option C is correct because enabling automatic key rotation in KMS once a year rotates the backing key, and snapshots are encrypted with the key. Option A is wrong because manual snapshot export is complex. Option B is wrong because separate keys for each snapshot add overhead. Option D is wrong because copying snapshots with a new key is manual and time-consuming.

Answer

Copy each snapshot to a new snapshot encrypted with a new KMS key

Answer

Export snapshots to S3 and use S3 Batch Operations to re-encrypt them

Answer

Use a different KMS key for each snapshot and rotate the key manually

Question 18

A company wants to protect data at rest for an Amazon S3 bucket that contains sensitive data. Which combination of actions provides the MOST comprehensive protection? (Choose two.)

Accepted Answer

Enable default encryption on the bucket with SSE-S3. Option B is correct because enabling default encryption with SSE-S3 ensures that all objects uploaded to the bucket are automatically encrypted at rest using server-side encryption with Amazon S3-managed keys (AES-256). Option C is correct because configuring a bucket policy to deny requests over HTTP enforces HTTPS for all data in transit, preventing exposure of sensitive data during transmission. Together, they protect data both at rest and in transit, providing comprehensive coverage.

Answer

Enable versioning on the bucket

Answer

Enable MFA Delete on the bucket

Answer

Configure a lifecycle policy to transition objects to Glacier

Question 19

A company uses AWS KMS to encrypt data in Amazon S3. The security team receives an alert that an IAM user is attempting to decrypt data using a key that they do not have access to. Which AWS service can be used to monitor and alert on such unauthorized KMS API calls?

Accepted Answer

AWS CloudTrail with CloudWatch Alarms. Option B is correct because CloudTrail logs all KMS API calls, and CloudWatch Alarms can trigger alerts on specific events. Option A is wrong because GuardDuty focuses on threat detection, not specific API calls. Option C is wrong because Config monitors resource configurations, not API calls. Option D is wrong because Inspector is for vulnerability assessment.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Inspector

Question 20

A company needs to encrypt data in transit between an EC2 instance and an RDS database. Which option should be used?

Accepted Answer

Configure the database to use SSL/TLS connections. Option B is correct because encrypting data in transit between an EC2 instance and an RDS database requires the use of SSL/TLS protocols to secure the communication channel. AWS RDS supports SSL/TLS connections by enabling the `require_secure_transport` parameter or using a certificate bundle on the client side, ensuring that all data transmitted over the network is encrypted and protected from eavesdropping or man-in-the-middle attacks.

Answer

Enable encryption at rest for the RDS instance

Answer

Use an AWS KMS key to encrypt the connection

Answer

Enable EBS encryption on the EC2 instance