SCS-C02 Data Protection Practice Test 10 — 15 Questions

Question 1

A multinational corporation uses AWS Organizations to manage multiple accounts. The security team requires that all data in S3 buckets across all accounts be encrypted at rest using customer-managed KMS keys. They have created a Service Control Policy (SCP) to deny creation of S3 buckets without encryption. However, upon testing, they find that a user in a member account can still create an unencrypted bucket. The SCP is attached to the root organizational unit. The SCP statement is: {"Effect":"Deny","Action":"s3:CreateBucket","Resource":"*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}. What is the MOST likely reason the SCP is not working?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SCP does not apply to the management account where the test was performed.. SCPs do not apply to the management account of an AWS Organization. Even if the SCP is attached to the root OU, it only affects member accounts, not the management account. Therefore, if the test was performed in the management account, the SCP would have no effect, allowing the creation of an unencrypted bucket. This is the most likely reason the SCP is not working.

Answer

The SCP requires the member account to enable SCP enforcement.

Answer

The condition key s3:x-amz-server-side-encryption is incorrect; the correct key is s3:x-amz-server-side-encryption-aws-kms-key-id.

Answer

The SCP is not effective because IAM policies are evaluated before SCPs.

Question 2

A company uses AWS Shield Advanced to protect its web application against DDoS attacks. The application runs behind an Application Load Balancer (ALB) and uses Amazon CloudFront as a CDN. The security team notices that some requests are bypassing CloudFront and hitting the ALB directly. They want to ensure that all traffic goes through CloudFront to benefit from DDoS protection and to enforce encryption in transit. The ALB has a public DNS name and is accessible from the internet. What should the security team do to restrict direct access to the ALB while allowing CloudFront traffic?

Accepted Answer

Configure CloudFront to add a custom header to requests, and configure the ALB's security group to allow traffic only from CloudFront's IP addresses and that contains the custom header.. The correct answer. To restrict direct access to the ALB while allowing CloudFront traffic, the security team should configure CloudFront to add a custom header (e.g., X-Origin-Verify) to all requests forwarded to the ALB. Then, configure the ALB's security group to allow inbound traffic only from CloudFront's IP addresses, and configure the ALB's listener rule to require the presence of the custom header. This two-layer approach ensures that only requests originating from CloudFront and containing the expected header are accepted. Option A is incorrect because network ACLs are stateless and cannot inspect HTTP headers; they only filter at the network layer. Option C is incorrect because AWS WAF alone cannot prevent direct connections to the ALB at the network level; it only inspects application-layer traffic after the connection is established. Option D is incorrect because a security group rule allowing only CloudFront's IP addresses does not verify the request originated from CloudFront—an attacker could spoof an IP or use a CloudFront origin feature to bypass.

Answer

Use a network ACL to restrict inbound traffic to only CloudFront's IP addresses.

Answer

Deploy AWS WAF on the ALB with a rule that blocks requests that do not originate from CloudFront.

Answer

Create a security group rule that allows traffic only from CloudFront's IP addresses and denies all other traffic.

Question 3

A security engineer manages a fleet of Amazon EC2 instances that process highly sensitive data. The instances use Amazon EBS volumes encrypted with an AWS KMS customer managed key. The company requires that if a volume is ever detached from an instance, its data cannot be read by any other principal, even if the volume snapshot is shared. The engineer also wants to maintain the ability to restore the volume later. What should the engineer do?

Accepted Answer

Disable the KMS key used to encrypt the volumes.. Disabling the KMS key immediately blocks all cryptographic operations that use it, which stops any principal from decrypting the EBS volume or its snapshots. Because the key is not deleted, it can be re-enabled later to restore access, meeting the reversible-restore requirement. Re-encryption, rotation, and non-existent volume policies do not revoke access to existing ciphertext.

Answer

Apply a resource-based policy to the EBS volumes that denies all principals except the instance role.

Answer

Enable automatic key rotation on the KMS key used to encrypt the volumes.

Answer

Create a new KMS key and re-encrypt all existing EBS volumes with it.

Question 4

A company uses AWS KMS to encrypt an Amazon RDS for PostgreSQL database. The security team wants to ensure that the database can only be decrypted by principals within a specific AWS account and that the KMS key cannot be used by any other account. The KMS key is a customer managed key in account A. The RDS instance is in account A. Which combination of key policy and IAM policy changes will meet these requirements?

Accepted Answer

Modify the KMS key policy to allow only the specific IAM roles in account A that need access, and remove any statements that grant access to other accounts.. The KMS key policy is the authoritative access control for a KMS key. To restrict usage to specific principals in account A and prevent other accounts from using the key, you must modify the key policy to explicitly allow only those principals and remove any statements that grant access to other accounts or the account root. IAM policies alone cannot override a key policy that grants access to other accounts. Automatic rotation and grants do not address the access control requirement.

Answer

Attach an IAM policy to the RDS instance's role that allows kms:Decrypt on the key, and rely on the default key policy to deny other accounts.

Answer

Enable automatic key rotation on the KMS key to ensure that only the current key material can decrypt the database.

Answer

Use a KMS grant to allow the RDS service to use the key, and remove all other statements from the key policy.

Question 5

A security engineer is designing encryption for a new application that stores sensitive data in Amazon S3. The company requires that the application retain full control over the encryption keys, including the ability to rotate them on demand, and that all data be encrypted with a key that is not shared with any other AWS service. The application runs on Amazon EC2 and uses the AWS SDK to encrypt and decrypt objects. Which TWO actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Use client-side encryption with a key stored in an encrypted Amazon EBS volume attached to the EC2 instance.. To retain full control and avoid sharing keys with other AWS services, the application must manage keys outside of AWS KMS or S3 managed keys. Using AWS CloudHSM provides dedicated HSMs, and storing a key on an encrypted EBS volume gives the application direct control. Both allow on-demand rotation and keep the key exclusive to the application, unlike SSE-KMS, SSE-S3, or Secrets Manager.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3).

Answer

Use client-side encryption with a customer-provided key stored in AWS Secrets Manager.

Answer

Use AWS KMS customer managed keys with SSE-KMS for the S3 bucket.

Question 6

A security engineer is enabling encryption at rest for an Amazon RDS for PostgreSQL database. The database must be encrypted with a customer managed key in AWS KMS. The engineer creates the RDS instance with encryption enabled and selects the customer managed key. What else must the engineer do to ensure that the RDS instance can use the key?

Accepted Answer

Modify the KMS key policy to allow the RDS service-linked role to use the key for cryptographic operations.. RDS uses the service-linked role AWSServiceRoleForRDS to access KMS keys for encryption. The key policy must allow this role to perform necessary KMS operations. Without this, RDS cannot use the customer managed key. Modifying the key policy to grant access to the service-linked role is required.

Answer

Ensure that the IAM role associated with the RDS instance has permissions to use the KMS key for encrypt and decrypt operations.

Answer

Enable automatic key rotation on the KMS key to allow RDS to access it.

Answer

Attach an IAM policy to the RDS instance's security group that allows access to the KMS key.

Question 7

A security engineer is designing a solution to protect data at rest in Amazon EBS volumes for a fleet of EC2 instances. The company requires that all EBS volumes be encrypted with a customer managed key in AWS KMS and that the encryption cannot be disabled by users. The engineer must also ensure that snapshots of these volumes remain encrypted. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Enable encryption by default and restrict permissions to modify the default encryption settings using an IAM policy.. Enabling EBS encryption by default with a customer managed key ensures that all new EBS volumes and snapshots in the Region are encrypted. Restricting permissions to modify the default encryption settings prevents users from disabling or changing the encryption. Together, these actions enforce encryption and prevent users from bypassing it. Other options either rely on user compliance, are reactive, or do not cover snapshots.

Answer

Configure the EC2 instances to use encrypted EBS volumes by specifying the KMS key in the block device mapping at launch.

Answer

Create a custom AWS Config rule that checks for unencrypted EBS volumes and automatically deletes them.

Answer

Use an IAM policy to deny the ec2:CreateVolume and ec2:CreateSnapshot actions if the request does not include encryption parameters.

Question 8

A security engineer is configuring AWS KMS to support a new application that requires encryption of data at rest using a symmetric key. The application must be able to encrypt and decrypt data up to 4 KB directly with the KMS key, and the security team wants to minimize the risk of key material exposure. The engineer creates a customer managed key with key spec SYMMETRIC_DEFAULT and key usage ENCRYPT_DECRYPT. Which additional configuration should the engineer apply to meet the requirement of minimizing key material exposure while allowing the application to encrypt and decrypt small data blobs?

Accepted Answer

Enable automatic key rotation and use the KMS key directly for encrypt and decrypt operations.. Using a symmetric KMS key directly for encrypt and decrypt operations keeps the key material within AWS KMS HSMs, minimizing exposure. Automatic key rotation further reduces risk by periodically changing the backing key material. Exporting key material or using data keys locally would expose key material to the application environment, which is not desired. Asymmetric keys are not suited for this symmetric encryption use case.

Answer

Export the KMS key material to the application server and use it for local encryption and decryption.

Answer

Use an asymmetric KMS key with RSA_2048 and encrypt the data blobs with the public key.

Answer

Create a data key using the KMS key and use the data key to encrypt the data blobs on the application server.

Question 9

A security engineer is configuring AWS KMS to encrypt data for a new application. The application will use a customer managed key to encrypt data at rest in Amazon S3. The engineer needs to ensure that the key can be used by the application's IAM role but cannot be used by any other IAM principals in the account. The application's IAM role is named AppRole. Which combination of key policy and IAM policy should the engineer implement to meet these requirements?

Accepted Answer

In the key policy, grant kms:Encrypt and kms:Decrypt to the AppRole. Do not allow any other principals. In the IAM policy for AppRole, allow kms:Encrypt and kms:Decrypt on the key.. The correct configuration restricts key usage to the application's IAM role by explicitly allowing only that role in the key policy and granting only the necessary permissions in the IAM policy. AWS KMS requires that both the key policy and IAM policy allow the action, unless the key policy delegates to IAM. By not granting permissions to other principals, the key is effectively restricted to AppRole.

Answer

In the key policy, grant kms:Encrypt and kms:Decrypt to AppRole. In the IAM policy for AppRole, allow kms:* on the key.

Answer

In the key policy, grant kms:* to the account root user. In the IAM policy for AppRole, allow kms:Encrypt and kms:Decrypt on the key.

Answer

In the key policy, grant kms:Encrypt and kms:Decrypt to AppRole and also grant kms:* to the account root user. In the IAM policy for AppRole, allow kms:Encrypt and kms:Decrypt on the key.

Question 10

A security engineer is configuring AWS KMS to encrypt data for a new application. The engineer creates a customer managed key and needs to grant the application's IAM role permission to use the key for encryption and decryption. The engineer also needs to ensure that the key can be used by the application even if the IAM role is deleted and recreated with the same name. Which key policy statement should the engineer use?

Accepted Answer

A statement that grants kms:Encrypt and kms:Decrypt to the account principal, and an IAM policy that grants the permissions to the role.. The key policy should grant permissions to the account principal (e.g., arn:aws:iam::account-id:root) to delegate access control to IAM policies. This allows any IAM role with the correct IAM policy to use the key, even if the role is deleted and recreated. The IAM policy must grant the necessary kms:Encrypt and kms:Decrypt permissions to the role.

Answer

A statement that grants kms:Encrypt and kms:Decrypt to the IAM role's unique principal ID.

Answer

A statement that grants kms:Encrypt and kms:Decrypt to the account root user, and an IAM policy that grants the permissions to the role.

Answer

A statement that grants kms:Encrypt and kms:Decrypt to the IAM role's ARN.

Question 11

A financial services company uses AWS KMS to encrypt sensitive data. The security team has a requirement to rotate the CMK every 90 days and to maintain a record of all previous key versions for decryption of historical data. The team creates a new CMK every 90 days and manually updates applications to use the new key. This process is error-prone and causes downtime. What is the MOST operationally efficient solution that meets the requirements?

Accepted Answer

Create a new CMK every 90 days and update the alias to point to the new key. Applications reference the alias.. It uses aliases to decouple the key identifier from the application configuration. By creating a new CMK every 90 days and updating the alias to point to the new key, applications that reference the alias automatically use the new key without code changes, eliminating downtime. AWS KMS aliases are mutable pointers that can be reassigned to different CMKs, and the old key versions remain available for decryption of historical data.

Answer

Enable automatic key rotation on the existing CMK.

Answer

Use a CMK with imported key material and rotate the material every 90 days.

Answer

Continue creating new CMKs but use a script to update the application configuration files.

Question 12

A company is designing a data protection strategy for its Amazon S3 bucket that stores sensitive documents. The security team requires that all data be encrypted in transit and at rest, and that any accidental deletion of objects can be reversed within 30 days. Additionally, the company must be able to audit all access attempts to the bucket, including failed attempts. Which TWO actions should the company take to meet these requirements? (Choose two.)

Accepted Answer

Enable AWS CloudTrail with data events for S3.. AWS CloudTrail with data events for S3 is correct because it captures all S3 API calls, including GetObject, PutObject, and DeleteObject, and records both successful and failed access attempts. This meets the auditing requirement for all access attempts, including failed ones, as CloudTrail logs the request details, error codes, and source IP addresses.

Answer

Enable default encryption on the bucket using SSE-S3.

Answer

Enable S3 server access logs and send them to a separate bucket.

Answer

Enable MFA Delete on the bucket.

Question 13

A healthcare company runs a HIPAA-compliant application on AWS. The application uses Amazon S3 to store Protected Health Information (PHI). The company has implemented the following controls: (1) All S3 buckets are configured with default encryption using SSE-S3. (2) Bucket policies restrict access to only authorized IAM roles. (3) S3 access logs are enabled and sent to a centralized logging account. (4) MFA Delete is enabled on all buckets. (5) Object lock is not enabled. Recently, an internal auditor discovered that when an authorized user deletes an object, the object is permanently deleted and cannot be recovered. The company's data retention policy requires that deleted PHI be recoverable for at least 30 days after deletion. A review of the IAM policies shows that users have s3:DeleteObject permission. The auditor also notes that the bucket versioning is not enabled. The security team needs to implement a solution that allows authorized users to delete objects but ensures that deleted objects can be recovered within 30 days. Which of the following is the MOST effective course of action?

Accepted Answer

Enable S3 Versioning on the buckets and ensure that the IAM policies include s3:DeleteObjectVersion where appropriate.. Enabling S3 Versioning is the most effective solution because it preserves all object versions, including deleted objects (which become delete markers). With versioning enabled, authorized users can still use s3:DeleteObject to delete the current version, but the previous versions remain recoverable. Since the requirement is to recover deleted PHI within 30 days, versioning combined with a lifecycle policy to permanently delete old versions after 30 days would meet the retention policy without blocking immediate deletion.

Answer

Enable S3 Object Lock in Governance mode with a retention period of 30 days.

Answer

Remove the s3:DeleteObject permission from all IAM policies and use S3 Lifecycle policies to expire objects after 30 days.

Answer

Change the default encryption from SSE-S3 to SSE-C and use a separate key for each object.

Question 14

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which solution meets this requirement?

Accepted Answer

Use a customer managed key and enable automatic rotation with a yearly rotation period.. Customer managed keys (CMKs) in AWS KMS support automatic rotation with a customizable rotation period, which can be set to 365 days (one year) to meet the security team's requirement. AWS managed keys, on the other hand, have a fixed automatic rotation period of every three years (1095 days) and cannot be adjusted, making them unsuitable for a yearly rotation mandate. By using a CMK with automatic rotation enabled and specifying a rotation period of one year, the company ensures that the encryption key material is rotated annually without manual intervention.

Answer

Use an AWS managed key and enable automatic rotation.

Answer

Use a customer managed key with imported key material and enable automatic rotation.

Answer

Use an AWS managed key and manually rotate it every year.

Question 15

Refer to the exhibit. An AWS KMS key policy includes the statement shown. The AdminRole tries to decrypt a ciphertext that was encrypted using the same KMS key with encryption context 'department=engineering'. What will happen?

Accepted Answer

The decrypt operation fails because the encryption context does not match the condition.. The KMS key policy includes a condition that requires the encryption context to be 'department=finance' for decryption. When the AdminRole attempts to decrypt, the encryption context must match both the encryption context used during encryption and any conditions in the key policy. Since the ciphertext was encrypted with 'department=engineering', the decryption fails because the encryption context does not satisfy the policy condition, even though the role has kms:Decrypt permission.

Answer

The decrypt operation succeeds because the role has kms:Decrypt permission.

Answer

The decrypt operation succeeds because the encryption context is ignored during decryption.

Answer

The decrypt operation fails because the policy does not allow kms:Decrypt without matching context.