SCS-C02 Data Protection Practice Test 11 — 15 Questions

Question 1

Drag and drop the steps to configure a VPC with private subnets and NAT gateway for outbound internet access in the correct order.

Accepted Answer

Create VPC, then create subnets, then create and attach Internet Gateway, then create NAT Gateway, then update route tables.. VPC creation, subnets, internet gateway, NAT gateway, and route table update are required for private subnet internet access.

Answer

Create VPC, then create subnets, then create NAT Gateway, then create and attach Internet Gateway, then update route tables.

Answer

Create VPC, then create subnets, then create and attach Internet Gateway, then update route tables, then create NAT Gateway.

Answer

Create VPC, then create NAT Gateway, then create subnets, then create and attach Internet Gateway, then update route tables.

Question 2

Match each AWS security-related acronym to its definition.

Accepted Answer

SOC: Report on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy.. The correct matches are: SOC with service organization controls, PCI DSS with credit card security, HIPAA with healthcare privacy, and FedRAMP with cloud authorization. Common confusions include mixing HIPAA with SOC and PCI DSS with FedRAMP.

Answer

SOC: US law designed to provide privacy standards to protect patients' medical records and other health information.

Answer

PCI DSS: US government program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services.

Question 3

A company wants to protect data at rest for an Amazon RDS for PostgreSQL database. Which AWS service should be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). Amazon RDS for PostgreSQL integrates with AWS Key Management Service (KMS) to enable encryption at rest. When you enable encryption for an RDS DB instance, KMS manages the customer master keys (CMKs) that encrypt the data keys used by the storage layer. This is the standard, fully managed key management service for RDS encryption, supporting automatic key rotation and fine-grained access control.

Answer

AWS CloudHSM

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 4

A company has a requirement to automatically rotate encryption keys for S3 objects every 90 days. They are using SSE-KMS with a customer managed key. Which action will meet the requirement without breaking access to existing objects?

Accepted Answer

Use S3 Batch Operations to re-encrypt existing objects with the new key. (S3 Batch Operations) allows re-encrypting existing objects with a new key without breaking access because the previous key remains available for decryption. Option E (Enable automatic key rotation in AWS KMS) rotates the key annually, not every 90 days, so it does not meet the requirement. No other combination of options fully satisfies the 90-day rotation requirement; thus only B is correct.

Answer

Configure an S3 lifecycle policy to re-encrypt objects

Answer

Manually rotate the key every 90 days and re-encrypt all objects

Answer

Delete the existing key and create a new one each 90 days

Answer

Enable automatic key rotation in AWS KMS for the customer managed key

Question 5

A company needs to ensure that data in transit between an on-premises data center and Amazon S3 is encrypted. Which AWS service should be used to establish a dedicated encrypted connection?

Accepted Answer

AWS Direct Connect with VPN. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, but it does not inherently encrypt data in transit. By combining Direct Connect with a VPN (IPsec tunnel), you get both a dedicated connection and encryption of all traffic between the on-premises network and Amazon S3. This ensures data in transit is protected while avoiding the public internet.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Question 6

A company is designing a data protection strategy for an Amazon RDS for MySQL database. The database is 2 TB in size and stores financial data. The compliance team requires that database snapshots be encrypted at rest and that encryption keys be rotated every year. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable automatic key rotation in AWS KMS for the KMS key used for RDS encryption. Enabling automatic key rotation in AWS KMS for the KMS key used for RDS encryption meets the compliance requirement of yearly key rotation without any manual effort. RDS automatically uses the rotated key for new snapshots, and existing snapshots remain encrypted with the original key but can be decrypted with the new key as KMS maintains the key hierarchy. Option A is wrong because copying snapshots to re-encrypt with a new KMS key requires manual scripting and adds operational overhead. Option B is wrong because exporting snapshots to S3 and using S3 Batch Operations is complex and unnecessary. Option C is wrong because using a different KMS key for each snapshot and manually rotating adds significant operational overhead and does not leverage the automatic rotation capability of KMS.

Answer

Copy each snapshot to a new snapshot encrypted with a new KMS key

Answer

Export snapshots to S3 and use S3 Batch Operations to re-encrypt them

Answer

Use a different KMS key for each snapshot and rotate the key manually

Question 7

A company uses AWS KMS to encrypt data in Amazon S3. The security team receives an alert that an IAM user is attempting to decrypt data using a key that they do not have access to. Which AWS service can be used to monitor and alert on such unauthorized KMS API calls?

Accepted Answer

AWS CloudTrail with CloudWatch Alarms. AWS CloudTrail logs all KMS API calls, and CloudWatch Alarms can be configured to trigger on specific unauthorized API calls, such as Decrypt attempts with a key the user does not have access to. Option A is incorrect because Amazon GuardDuty is a threat detection service that focuses on identifying malicious activity, but it does not provide detailed monitoring of specific KMS API calls. Option B is incorrect because AWS Config evaluates resource configurations and compliance, not API calls. Option D is incorrect because Amazon Inspector is a vulnerability assessment service for EC2 instances and does not monitor API calls.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon Inspector

Question 8

A company needs to encrypt data in transit between an EC2 instance and an RDS database. Which option should be used?

Accepted Answer

Configure the database to use SSL/TLS connections. Encrypting data in transit between an EC2 instance and an RDS database requires the use of SSL/TLS protocols to secure the communication channel. AWS RDS supports SSL/TLS connections by enabling the `require_secure_transport` parameter or using a certificate bundle on the client side, ensuring that all data transmitted over the network is encrypted and protected from eavesdropping or man-in-the-middle attacks.

Answer

Enable encryption at rest for the RDS instance

Answer

Use an AWS KMS key to encrypt the connection

Answer

Enable EBS encryption on the EC2 instance

Question 9

A company is using AWS KMS to encrypt S3 objects. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which KMS key policy configuration should be used?

Accepted Answer

Add a condition that allows decrypt only when kms:ViaService is s3.amazonaws.com and the caller role matches the specific role ARN.. A KMS key policy with a condition restricting kms:Decrypt to the specific IAM role ARN and kms:ViaService set to s3.amazonaws.com ensures only that role, acting through S3, can decrypt objects. This is the authoritative control because KMS key policies govern all access to the CMK, and the ViaService condition prevents the role from using the key directly outside S3.

Answer

Use an S3 bucket policy that denies decrypt for all principals except the specific IAM user.

Answer

Configure the IAM role with a policy that allows kms:Decrypt for the specific KMS key.

Answer

Attach a resource-based policy to the S3 bucket that grants decrypt permission to the IAM role.

Question 10

A financial services company must ensure that all data at rest in Amazon RDS for PostgreSQL is encrypted. The current database is unencrypted. What is the MOST operationally efficient way to enable encryption?

Accepted Answer

Take a snapshot of the database, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. The most operationally efficient way to enable encryption on an existing unencrypted RDS for PostgreSQL database is to take a snapshot, copy the snapshot with encryption enabled, and restore it to a new encrypted DB instance. This method leverages RDS's native snapshot and restore capabilities, minimizing manual intervention and downtime. Other methods like exporting and importing data are more complex and time-consuming, and encryption cannot be enabled directly on an existing instance.

Answer

Export the database to S3 using pg_dump, then import into a new encrypted RDS instance.

Answer

Create a read replica with encryption enabled and promote it to primary.

Answer

Enable encryption directly on the existing RDS instance by modifying the DB instance settings.

Question 11

A company needs to securely store database credentials for a legacy application running on Amazon EC2. The credentials are currently hardcoded in the application code. Which service should be used to rotate and retrieve secrets automatically?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials. It natively supports automatic rotation via Lambda functions and provides fine-grained access control using IAM and KMS. The legacy application can retrieve credentials programmatically using the Secrets Manager API or SDK, eliminating hardcoded credentials.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

AWS Key Management Service (KMS).

Answer

AWS CloudHSM.

Question 12

A company wants to use client-side encryption for data uploaded to Amazon S3. The encryption keys must be managed by the company and never sent to AWS. Which S3 encryption option supports this requirement?

Accepted Answer

Client-side encryption using the Amazon S3 encryption client.. Client-side encryption using the Amazon S3 encryption client is correct because the encryption process occurs entirely on the client side before data is uploaded to S3. The company manages the encryption keys locally and never transmits them to AWS, satisfying the requirement that keys are never sent to AWS.

Answer

Server-side encryption with AWS KMS (SSE-KMS).

Answer

Server-side encryption with S3 managed keys (SSE-S3).

Answer

Server-side encryption with customer-provided keys (SSE-C).

Question 13

A company needs to encrypt data in transit between an on-premises data center and Amazon S3. Which solution should they use?

Accepted Answer

Use HTTPS endpoints for S3 API calls.. HTTPS (HTTP over TLS) encrypts data in transit between the on-premises data center and Amazon S3 by using TLS 1.2/1.3 to secure the API calls. This ensures that all data transmitted over the network is encrypted end-to-end, protecting it from eavesdropping and man-in-the-middle attacks. AWS S3 enforces HTTPS for all API requests when using the default endpoint, and customers can also configure bucket policies to deny HTTP requests.

Answer

Use AWS KMS to encrypt the data before transmission.

Answer

Use an S3 VPC endpoint.

Answer

Use S3 Transfer Acceleration.

Question 14

A company has a requirement to automatically rotate encryption keys for Amazon EBS volumes every 90 days. The EBS volumes are encrypted using AWS KMS. What is the simplest way to meet this requirement?

Accepted Answer

Create a new KMS key every 90 days and re-encrypt volumes using a script.. KMS automatic key rotation creates new backing keys yearly, not every 90 days. To meet the 90-day rotation requirement, you must manually create a new KMS key every 90 days and then re-encrypt the EBS volumes (e.g., by taking a snapshot, copying it with the new key, and restoring). Option A is incorrect because AWS Secrets Manager manages secrets, not KMS keys; it cannot rotate KMS keys. Option C is incorrect because client-side encryption would require managing keys outside of KMS, which adds complexity and does not meet the requirement of using AWS KMS. Option D is incorrect because automatic key rotation on the existing KMS key only rotates the backing key once per year, not every 90 days.

Answer

Use AWS Secrets Manager to rotate the KMS key automatically.

Answer

Switch to client-side encryption and rotate keys manually.

Answer

Enable automatic key rotation on the existing KMS key.

Question 15

A company uses AWS CloudTrail to log API activity. The security team wants to ensure that log files are encrypted at rest and that any tampering with logs is detectable. Which combination of services should be used?

Accepted Answer

Enable CloudTrail log file SSE-KMS encryption and enable CloudTrail log file integrity validation.. CloudTrail log file integrity validation produces digest files signed with SHA-256 and RSA that let you prove logs were not altered or deleted after delivery, while SSE-KMS encryption protects the log objects at rest with a customer-managed or AWS-managed KMS key. Together they satisfy both the confidentiality and tamper-detection requirements. This is the AWS-documented combination for secure, verifiable CloudTrail log storage.

Answer

Enable CloudTrail and configure S3 bucket to use default encryption and enable S3 server access logs.

Answer

Use AWS CloudHSM to generate keys and encrypt CloudTrail logs at the application layer.

Answer

Enable CloudTrail log file encryption using SSE-S3 and store logs in CloudWatch Logs.