SCS-C02 Data Protection Practice Test 10 — 15 Questions

Question 1

A company runs a web application on Amazon EC2 behind an Application Load Balancer (ALB). The application handles payment card information (PCI) and must comply with PCI DSS. The security team wants to ensure that all data in transit between the client and the ALB is encrypted using TLS 1.2 or higher. The ALB currently uses a default certificate from AWS Certificate Manager (ACM) that was issued by Amazon. The compliance team has flagged that the certificate must be issued by a public Certificate Authority (CA) that is trusted by major browsers. The company wants to minimize operational overhead. What should the security team do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Request a public certificate from ACM and associate it with the ALB. AWS Certificate Manager (ACM) can issue public certificates from trusted certificate authorities (CAs) such as Amazon Trust Services at no additional cost. These certificates support TLS 1.2 and 1.3 and are automatically renewed, minimizing operational overhead. ACM public certificates are trusted by major browsers because they are issued by a public CA. Option A is incorrect because CloudHSM is used for hardware-based key management, not for issuing public certificates; importing a certificate from CloudHSM would require manual renewal. Option B is incorrect because CloudFront's default certificate is for CloudFront distributions, not for ALBs; using CloudFront would introduce unnecessary complexity and cost. Option C is incorrect because self-signed certificates are not trusted by browsers and would require manual renewal and distribution.

Answer

Use AWS CloudHSM to generate a certificate and import it into ACM

Answer

Configure CloudFront in front of the ALB and use a CloudFront default certificate

Answer

Generate a self-signed certificate on the EC2 instance and upload it to ACM, then associate it with the ALB

Question 2

A company uses Amazon S3 to store sensitive documents. The security engineer notices that an S3 bucket named 'documents-prod' has been configured with a bucket policy that allows s3:PutObject from any principal, but only if the request includes the x-amz-server-side-encryption header set to 'AES256'. The company's security policy requires that all objects be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). The engineer needs to ensure that any new objects uploaded to the bucket are encrypted with SSE-KMS, and that existing objects remain accessible. What should the engineer do?

Accepted Answer

Update the bucket policy to require the x-amz-server-side-encryption header set to 'aws:kms' and specify the desired KMS key ARN. Updating the bucket policy to require the x-amz-server-side-encryption header set to 'aws:kms' and specifying the desired KMS key ARN enforces that all new uploads use SSE-KMS. Existing objects are not affected by the policy change and remain accessible. Option A is incorrect because creating a new bucket and migrating objects is unnecessary and more complex; the existing bucket can be updated directly. Option B is incorrect because modifying the bucket's default encryption only sets a default encryption method but does not enforce it via policy; users can still upload without specifying encryption and the default will apply, but if they specify a different encryption header, it might override. Option D is incorrect because S3 Object Lock and lifecycle policies do not enforce encryption requirements during upload; they only manage object retention and expiration.

Answer

Create a new bucket with a bucket policy that requires SSE-KMS, and migrate all objects using S3 Batch Operations

Answer

Modify the bucket's default encryption configuration to use SSE-KMS

Answer

Enable S3 Object Lock on the bucket to prevent overwrites, and use a lifecycle policy to expire objects that are not encrypted with SSE-KMS

Question 3

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which policy configuration should be used?

Accepted Answer

Add a bucket policy with a condition that the kms:ViaService is s3.amazonaws.com. The bucket policy can include a condition using the kms:ViaService condition key set to s3.amazonaws.com, which ensures that decryption requests must come through S3. This allows only requests that originate from S3 (e.g., when the IAM role accesses the bucket) to decrypt, provided the role also has kms:Decrypt permission. Option A is incorrect because S3 access point policies control access to the access point, not KMS decryption. Option B is incorrect because source IP conditions do not restrict decryption to S3; they restrict based on IP address, which is not the requirement. Option C is incorrect because a KMS grant is typically used to delegate temporary access to another AWS principal, not to restrict a specific IAM role; a key policy with a principal condition is more appropriate.

Answer

Use an S3 access point policy to restrict access

Answer

Attach an IAM policy to the role that allows kms:Decrypt with a condition on the source IP

Answer

Create a KMS grant for the IAM role with Decrypt permission

Question 4

A financial services company must ensure that all data written to Amazon S3 is encrypted at rest and that the encryption keys are rotated every 90 days. The company also needs to maintain an audit trail of when keys were used. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use SSE-C with customer-provided keys and rotate keys using a Lambda function. (SSE-C with customer-provided keys and rotate keys using a Lambda function) is correct because it allows the company to enforce a 90-day key rotation schedule by using a custom Lambda function, which meets the requirement with relatively low operational overhead compared to fully manual solutions. SSE-C provides encryption at rest, and key usage can be audited via S3 server access logs and CloudTrail. Option A (SSE-S3) is incorrect because it does not support customer-controlled key rotation. Option C (SSE-KMS with automatic key rotation) is incorrect because automatic rotation occurs only once per year (365 days), not every 90 days as required. Option D (client-side encryption with the AWS Encryption SDK) is incorrect because it requires custom key management and rotation, increasing operational overhead.

Answer

Use SSE-S3 with default encryption enabled

Answer

Use SSE-KMS with a customer managed key and enable automatic key rotation

Answer

Use client-side encryption with the AWS Encryption SDK

Question 5

A company is designing a disaster recovery plan for its Amazon RDS for MySQL database. The database must be encrypted at rest. Which approach ensures that the database is encrypted and can be restored in another AWS Region?

Accepted Answer

Create a cross-Region read replica with encryption enabled. (Create a cross-Region read replica with encryption enabled) is correct because it continuously replicates data to another AWS Region and encryption at rest can be enabled, ensuring both disaster recovery and encryption. Option A is wrong because encryption cannot be enabled on an existing unencrypted DB instance; a new encrypted instance must be created. Option B is wrong because exporting to S3 and using cross-Region replication does not provide a real-time database replica and complicates recovery. Option C is wrong because while a manual snapshot can be copied to another Region with encryption, it does not provide continuous replication; it is a point-in-time backup, not a disaster recovery solution that minimizes data loss.

Answer

Enable encryption on the existing DB instance

Answer

Export the database to Amazon S3 and use S3 cross-Region replication

Answer

Create a manual snapshot and copy it to another Region with encryption

Question 6

A company stores sensitive customer data in Amazon S3. The security team has enabled default encryption with SSE-S3 on the bucket. The compliance team requires that all access to the bucket be logged and that any unauthorized access attempts be detected in real time. The company has AWS CloudTrail enabled. Which additional steps should the security team take to meet the compliance requirements?

Accepted Answer

Enable S3 server access logs and enable Amazon GuardDuty with S3 protection. Enabling S3 server access logs captures all requests to the bucket, satisfying the logging requirement, and Amazon GuardDuty with S3 protection can detect suspicious activity in real time, meeting the requirement for real-time detection of unauthorized access. Option B is incorrect because AWS Config rules monitor configuration changes, not real-time threat detection. Option C is incorrect because CloudTrail data events can log S3 operations, but Amazon Detective is for post-incident analysis, not real-time detection. Option D is incorrect because VPC Flow Logs log network traffic, not S3 access, and Amazon Athena is a query service, not a real-time detection tool.

Answer

Enable AWS Config rules to detect unauthorized access

Answer

Enable CloudTrail data events for the S3 bucket and use Amazon Detective

Answer

Enable VPC Flow Logs and use Amazon Athena to analyze logs

Question 7

A company is using AWS KMS to encrypt sensitive data in Amazon DynamoDB. The security team wants to ensure that the KMS key can only be used from within the company's VPC and not from the internet. The VPC has an interface VPC endpoint for KMS. What should the security team do to enforce this restriction?

Accepted Answer

Attach a VPC endpoint policy that denies access from outside the VPC. Attaching a VPC endpoint policy to the KMS interface VPC endpoint can deny requests that originate from outside the VPC, ensuring that the KMS key is only used from within the VPC. Option A is wrong because making the KMS key regional does not restrict network access; it only limits the key to a single region. Option B is wrong because security group rules apply to network traffic at the instance level, not to KMS API operations; they cannot restrict access to the KMS endpoint itself. Option C is wrong because an S3 bucket policy is used to control access to S3 resources, not KMS keys. Therefore, D is the correct answer.

Answer

Make the KMS key Regional and disable cross-Region access

Answer

Use security group rules to restrict access to the KMS endpoint

Answer

Create an S3 bucket policy that restricts access to the KMS key

Question 8

A financial services company uses AWS KMS to encrypt sensitive data in S3 and RDS. The security team requires a centralized audit trail of all KMS key usage, including key creation, deletion, and cryptographic operations. The audit logs must be stored in a separate AWS account for compliance. The team has enabled CloudTrail in the management account and configured a trail that logs to an S3 bucket in the audit account. However, they notice that KMS events such as Decrypt and GenerateDataKey are not appearing in the CloudTrail logs. The KMS key policy includes the following statement: {"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::management-account:root"},"Action":"kms:*","Resource":"*"}. What is the MOST likely reason for the missing KMS events?

Accepted Answer

CloudTrail is not configured to log KMS data events.. CloudTrail does log KMS events by default, but they are data events and must be explicitly enabled. Option B is correct because KMS data events (like Decrypt and GenerateDataKey) are not logged unless CloudTrail is configured to capture them. Option C is wrong because the key policy grants full access to the management account, so it is sufficient. Option D is wrong because cross-account access is not the issue; the trail is logging to an S3 bucket in the audit account, but that does not affect which events are logged.

Answer

The S3 bucket in the audit account does not have a bucket policy allowing writes from CloudTrail.

Answer

CloudTrail does not log KMS Decrypt and GenerateDataKey events.

Answer

The KMS key policy does not grant CloudTrail permission to log events.

Question 9

A startup is building a serverless application using AWS Lambda to process user-uploaded images. The images are stored in an S3 bucket with server-side encryption (SSE-S3) enabled. The Lambda function reads the images, performs transformations, and writes the results to a different S3 bucket. The security engineer wants to ensure that data is encrypted at rest and in transit throughout the pipeline. The Lambda function is configured with an IAM role that has permissions to read from the source bucket and write to the destination bucket. Which additional configuration is REQUIRED to ensure end-to-end encryption?

Accepted Answer

No additional configuration is required; Lambda uses HTTPS by default to call S3.. Lambda uses HTTPS by default when calling S3 API operations, ensuring encryption in transit. SSE-S3 provides encryption at rest on S3, so no additional configuration is needed for end-to-end encryption. Option A is incorrect because while a bucket policy can enforce HTTPS, it is not required; Lambda's default HTTPS connection already provides encryption in transit. Option C is incorrect because SSE-S3 does not use KMS; Lambda can read SSE-S3 encrypted objects without additional KMS permissions. Option D is incorrect because VPC endpoints are not required for encryption in transit; Lambda's default HTTPS calls to S3 are already encrypted.

Answer

Add a bucket policy to the source bucket that denies requests not using aws:SecureTransport.

Answer

Grant the Lambda function's IAM role permission to call KMS Decrypt and Encrypt.

Answer

Enable VPC endpoints for S3 and configure Lambda to use them.

Question 10

A multinational corporation uses AWS Organizations to manage multiple accounts. The security team requires that all data in S3 buckets across all accounts be encrypted at rest using customer-managed KMS keys. They have created a Service Control Policy (SCP) to deny creation of S3 buckets without encryption. However, upon testing, they find that a user in a member account can still create an unencrypted bucket. The SCP is attached to the root organizational unit. The SCP statement is: {"Effect":"Deny","Action":"s3:CreateBucket","Resource":"*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}. What is the MOST likely reason the SCP is not working?

Accepted Answer

The SCP does not apply to the management account where the test was performed.. The SCP does not apply to the management account; it only applies to member accounts. When testing from the management account, the SCP is not evaluated, so the user can create unencrypted buckets. Option A is incorrect because SCPs are automatically enforced on member accounts without needing explicit enablement. Option B is incorrect because the condition key `s3:x-amz-server-side-encryption` is correct for checking whether encryption is specified. Option C is incorrect because SCPs are evaluated after IAM policies and can still deny actions even if IAM policies allow them.

Answer

The SCP requires the member account to enable SCP enforcement.

Answer

The condition key s3:x-amz-server-side-encryption is incorrect; the correct key is s3:x-amz-server-side-encryption-aws-kms-key-id.

Answer

The SCP is not effective because IAM policies are evaluated before SCPs.

Question 11

A company is migrating sensitive customer data to Amazon RDS for MySQL. The security team requires that data be encrypted at rest and in transit. The database will be accessed by a web application running on Amazon EC2 instances in the same VPC. The RDS instance is launched with encryption enabled using an AWS managed KMS key. The security team also enables SSL/TLS for connections. Which additional step is necessary to ensure that the web application uses encrypted connections?

Accepted Answer

Configure the web application's database connection string to use SSL/TLS.. Even though SSL/TLS is enabled on the RDS instance, the client application (web application) must be configured to use SSL when connecting to the database. Without this configuration, the connection may default to an unencrypted channel, defeating the purpose of enabling SSL/TLS on the server side. Option A is incorrect because enabling encryption at rest on EC2 EBS volumes protects data at rest, not data in transit. Option B is incorrect because Service Control Policies (SCPs) are used to manage permissions across accounts in an organization and do not enforce application-level encryption settings. Option D is incorrect because the RDS instance uses an AWS managed KMS key for encryption at rest; additional KMS permissions are not required for SSL/TLS connections, which rely on certificates, not KMS keys.

Answer

Enable encryption at rest on the EC2 instance's EBS volumes.

Answer

Create an SCP to enforce SSL connections to RDS.

Answer

Grant the EC2 instance's IAM role permission to use the KMS key for decrypting RDS connections.

Question 12

A company uses AWS Shield Advanced to protect its web application against DDoS attacks. The application runs behind an Application Load Balancer (ALB) and uses Amazon CloudFront as a CDN. The security team notices that some requests are bypassing CloudFront and hitting the ALB directly. They want to ensure that all traffic goes through CloudFront to benefit from DDoS protection and to enforce encryption in transit. The ALB has a public DNS name and is accessible from the internet. What should the security team do to restrict direct access to the ALB while allowing CloudFront traffic?

Accepted Answer

Configure CloudFront to add a custom header to requests, and configure the ALB's security group to allow traffic only from CloudFront's IP addresses and that contains the custom header.. The correct answer. To restrict direct access to the ALB while allowing CloudFront traffic, the security team should configure CloudFront to add a custom header (e.g., X-Origin-Verify) to all requests forwarded to the ALB. Then, configure the ALB's security group to allow inbound traffic only from CloudFront's IP addresses, and configure the ALB's listener rule to require the presence of the custom header. This two-layer approach ensures that only requests originating from CloudFront and containing the expected header are accepted. Option A is incorrect because network ACLs are stateless and cannot inspect HTTP headers; they only filter at the network layer. Option C is incorrect because AWS WAF alone cannot prevent direct connections to the ALB at the network level; it only inspects application-layer traffic after the connection is established. Option D is incorrect because a security group rule allowing only CloudFront's IP addresses does not verify the request originated from CloudFront—an attacker could spoof an IP or use a CloudFront origin feature to bypass.

Answer

Use a network ACL to restrict inbound traffic to only CloudFront's IP addresses.

Answer

Deploy AWS WAF on the ALB with a rule that blocks requests that do not originate from CloudFront.

Answer

Create a security group rule that allows traffic only from CloudFront's IP addresses and denies all other traffic.

Question 13

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

Accepted Answer

Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.. AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.

Answer

Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.

Answer

Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.

Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.

Question 14

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Configure the target group to use HTTPS protocol.. Configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Use a network load balancer instead of an ALB.

Answer

Assign a certificate from ACM to the ALB listener.

Question 15

A company uses S3 to store sensitive customer data. The security team requires that all objects uploaded to S3 be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). A developer reports that some objects are being stored unencrypted. What is the MOST effective way to enforce this requirement?

Accepted Answer

Use a bucket policy to deny s3:PutObject if encryption is not set to aws:kms. A bucket policy with a Deny effect on s3:PutObject when the condition `s3:x-amz-server-side-encryption` is not equal to `aws:kms` enforces SSE-KMS for all uploads. Option A is incorrect because default encryption using SSE-S3 can be overridden by the PUT request, and it does not enforce KMS. Option C is incorrect because SCPs apply at the account or organizational unit level, not to individual buckets, and are less direct than bucket policies. Option D is incorrect because requiring the `x-amz-server-side-encryption` header alone does not mandate the value `aws:kms`; a requester could set it to `AES256` (SSE-S3).

Answer

Enable default encryption on the bucket using SSE-S3

Answer

Use an SCP to deny s3:PutObject without encryption

Answer

Set a bucket policy to require the x-amz-server-side-encryption header