SCS-C02 Data Protection Practice Test 11 — 15 Questions

Question 1

A company stores sensitive data in an S3 bucket with default encryption (SSE-S3) enabled. A security audit reveals that objects are being accessed by users from unexpected IP addresses. The company wants to enforce that only objects encrypted with a specific KMS key (managed by the security team) can be accessed. Which combination of actions should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the bucket policy to deny PutObject and GetObject unless the request includes the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header.. It uses a bucket policy with the 's3:x-amz-server-side-encryption-aws-kms-key-id' condition key to deny requests that do not include the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header. This enforces that only objects encrypted with the specified KMS key can be accessed. Option A is incorrect because SSE-C uses customer-provided keys and does not integrate with KMS key IDs; distributing a customer key does not enforce the specific KMS key. Option C is incorrect because S3 Block Public Access and AWS WAF do not control access based on encryption key. Option D is incorrect because lifecycle policies do not restrict access based on encryption key.

Answer

Use SSE-C and distribute the customer key to authorized users only.

Answer

Enable S3 Block Public Access and use AWS WAF to filter IP addresses.

Answer

Apply an S3 Lifecycle policy to transition objects to Glacier after 30 days.

Question 2

A company is using Amazon S3 to store sensitive customer data. They need to ensure that data is encrypted at rest and that the encryption keys are managed by the company, not AWS. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C is correct because it allows customers to provide and manage their own encryption keys. SSE-S3 uses AWS-managed keys. SSE-KMS uses AWS KMS keys which are managed by AWS, though the customer can manage KMS key policies but not the actual encryption keys used by S3. Client-side encryption is not an S3 server-side encryption option.

Answer

Client-side encryption

Answer

SSE-KMS

Answer

SSE-S3

Question 3

A company is using Amazon S3 to store sensitive data. They want to ensure that all objects uploaded to a specific bucket are encrypted using server-side encryption with AWS KMS. Which bucket policy condition should be used to enforce this?

Accepted Answer

Condition: 's3:x-amz-server-side-encryption': 'aws:kms'. Using the condition key 's3:x-amz-server-side-encryption' with value 'aws:kms' enforces that all objects uploaded to the bucket must use server-side encryption with AWS KMS (SSE-KMS). Option A is incorrect because it enforces SSE-C (customer-provided key), not SSE-KMS. Option C is incorrect because it checks the KMS key ID but does not enforce that encryption is actually requested; a request without any encryption header would still succeed. Option D is incorrect because it enforces SSE-S3 (AES256), not SSE-KMS.

Answer

Condition: 's3:x-amz-server-side-encryption-customer-algorithm': 'AES256'

Answer

Condition: 's3:x-amz-server-side-encryption-aws-kms-key-id': 'arn:aws:kms:...'

Answer

Condition: 's3:x-amz-server-side-encryption': 'AES256'

Question 4

A company uses AWS KMS with a custom key store backed by AWS CloudHSM. The security team wants to ensure that the key material never leaves the HSM and that all cryptographic operations are performed within the HSM. Which of the following actions should the team take?

Accepted Answer

Create the KMS key in a custom key store and set the key usage to 'ENCRYPT_DECRYPT'.. To ensure key material never leaves the HSM and cryptographic operations are performed within the HSM, the team should create the KMS key in a custom key store (backed by CloudHSM) and set the key usage to ENCRYPT_DECRYPT. This ensures that the key material is stored and used only within the HSM. Option A is incorrect because asymmetric keys with SIGN_VERIFY usage are not the standard for encryption/decryption, and the key material could potentially be exported if the HSM allows. Option B is incorrect because the 'Prevent key material export' option is not available in KMS; custom key stores inherently prevent export. Option C is incorrect because the default key store uses software-based keys, not HSM hardware. Therefore, Option D is the correct answer.

Answer

Create the KMS key as an asymmetric key in a custom key store and set the key usage to 'SIGN_VERIFY'.

Answer

Enable the 'Prevent key material export' option in the KMS key policy.

Answer

Create the KMS key as a symmetric key in the default key store.

Question 5

A company uses Amazon RDS for PostgreSQL with encryption at rest enabled using AWS KMS. The security team wants to ensure that database backups (automated snapshots) are also encrypted and that the encryption key can be rotated on demand without re-encrypting the data. Which approach should be taken?

Accepted Answer

Create a new KMS key and modify the RDS instance to use the new key. The existing backup will be re-encrypted with the new key when the instance is modified.. You can create a new KMS key and modify the RDS instance to use the new key. This action re-encrypts the database and its automated snapshots with the new key, providing on-demand key rotation. The re-encryption is performed automatically during the modification. Option A is incorrect because RDS does not allow specifying a separate KMS key for backups; backups use the same key as the instance. Option B is incorrect because disabling the old KMS key would break access to existing backups that are still encrypted with that key. Option C is incorrect because automatic key rotation in KMS does not trigger re-encryption of existing data; it only generates new key material for future encryption operations.

Answer

Use a separate KMS key for backups by enabling 'Copy tags to snapshots' and specifying a different key.

Answer

Disable the old KMS key and enable a new KMS key for the RDS instance. The old backup will remain encrypted with the old key.

Answer

Enable automatic key rotation in KMS and import new key material every 90 days.

Question 6

A company is using Amazon S3 to store confidential documents. They want to ensure that all data is encrypted in transit between the S3 bucket and their on-premises application. Which of the following should be enforced?

Accepted Answer

Add a bucket policy that denies access unless 'aws:SecureTransport' is true.. The 'aws:SecureTransport' condition in a bucket policy enforces HTTPS for all requests, ensuring encryption in transit. Option B is incorrect because CloudFront does not enforce HTTPS between CloudFront and the S3 origin by default; it can be configured but is not enforced solely by this option. Option C is incorrect because a VPC endpoint for S3 uses HTTPS by default, but does not enforce it; bucket policies are still needed. Option D is incorrect because SSE-S3 encrypts data at rest, not in transit.

Answer

Use Amazon CloudFront with a custom origin pointing to the S3 bucket.

Answer

Use a VPC endpoint for S3.

Answer

Enable default encryption (SSE-S3) on the bucket.

Question 7

A company is designing a secure data sharing solution with a third party. The company needs to share sensitive files stored in an S3 bucket with the third party, ensuring that the files are encrypted at rest and in transit, and that the third party can only access specific files. The company also wants to rotate the access credentials every 30 days. Which TWO actions should the company take? (Select TWO.)

Accepted Answer

Configure an S3 bucket policy that denies access unless the request includes a specific KMS key ID.. Options C and E are correct. Option C uses an S3 bucket policy with a condition requiring requests to include a specific KMS key ID, ensuring that only requests using that key can access the objects. This enforces encryption at rest (objects encrypted with that key) and in transit (HTTPS with KMS). Option E grants the third party's AWS account permission to use that KMS key for decrypt operations, allowing them to decrypt the files. Together, they provide encryption key control and the ability to rotate the key or its policy every 30 days. Option A (cross-account IAM role) does not enforce encryption key control and requires the third party to assume a role, but credential rotation is managed via role trust policy, not directly. Option B (S3 Cross-Region Replication) replicates objects but does not enforce key-specific access or encryption at rest in the destination. Option D (presigned URLs) provides time-limited access but does not enforce encryption key control and cannot be easily rotated every 30 days without regenerating URLs.

Answer

Create an IAM role in the company's account that the third party can assume, and attach a policy that grants access to the specific files.

Answer

Use S3 Cross-Region Replication to replicate the files to a bucket in the third party's account.

Answer

Generate presigned URLs for the specific files and email them to the third party.

Question 8

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to detect any attempts to use a KMS key that has been disabled. Which TWO steps should the team take to achieve this? (Select TWO.)

Accepted Answer

Enable AWS CloudTrail trails for the account to log KMS events.. Options A and B are correct. Enabling CloudTrail trails (A) captures all KMS API calls, including failed attempts to use a disabled key. Configuring a CloudWatch Events rule to send a notification to an SNS topic (B) ensures alerts are sent when such attempts occur. Option D is incorrect because it only triggers on the 'DisableKey' event, which indicates when a key is disabled, not when someone attempts to use a disabled key. Options C and E are incorrect because key rotation and disabling rotation do not help detect attempts to use a disabled key.

Answer

Configure automatic KMS key rotation to generate daily events.

Answer

Create a CloudWatch Events rule that matches the 'DisableKey' event from KMS.

Answer

Disable key rotation to prevent key material changes.

Question 9

A company is storing sensitive data in Amazon S3. They want to ensure that all data is encrypted at rest using server-side encryption. Which THREE options are available for server-side encryption in S3? (Select THREE.)

Accepted Answer

SSE-KMS. The three server-side encryption options in Amazon S3 are SSE-S3, SSE-KMS, and SSE-C. Option A (client-side encryption) is incorrect because it is not server-side. Option E (AWS CloudHSM) is incorrect because CloudHSM is a service for hardware security modules, not an S3 encryption option.

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 10

A company is migrating sensitive data to Amazon S3. They need to ensure that data is encrypted at rest using an AWS KMS customer managed key (CMK). The security team wants to enforce encryption for all new objects uploaded to an S3 bucket. Which policy should be attached to the bucket?

Accepted Answer

A bucket policy with a condition that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws:kms header. It uses a bucket policy condition that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms (though the option text shows a combined form). This enforces the use of AWS KMS customer managed key (CMK) for server-side encryption. Option A is incorrect because it only allows PutObject if the user has KMS permissions, which does not guarantee the object is encrypted with KMS; the user could still upload without encryption. Option B configures default encryption, but it can be overridden by the uploader; it does not enforce encryption. Option C is about lifecycle policy, not encryption enforcement.

Answer

A bucket policy that allows s3:PutObject only if the user has KMS permissions

Answer

An S3 bucket default encryption setting with AES256

Answer

An S3 Lifecycle policy to transition objects to Glacier after 30 days

Question 11

A company uses AWS CloudHSM to store encryption keys for a custom database encryption application. The application runs on Amazon EC2 instances and uses the PKCS#11 library to communicate with the HSM. Recently, the application started failing with 'CKR_SESSION_HANDLE_INVALID' errors. Which of the following is the most likely cause?

Accepted Answer

The application is not closing sessions properly, causing the HSM to reach the maximum number of open sessions. CloudHSM partitions have a limit on the number of open sessions. If the application does not properly close sessions, it can exhaust the limit, causing invalid session handle errors. Option C identifies this. Option A would cause different errors, B is about connectivity, D is about certificates.

Answer

The client certificate used for mutual TLS authentication has expired

Answer

The security group for the HSM does not allow inbound traffic from the EC2 instance

Answer

The HSM's firmware version is incompatible with the PKCS#11 library

Question 12

A company uses S3 Server Access Logs to audit access to their S3 buckets. The security team wants to ensure that the log files themselves are encrypted at rest using SSE-KMS. Which configuration step is necessary?

Accepted Answer

Add a bucket policy on the destination bucket that grants the S3 log delivery service permission to use the KMS key. To encrypt S3 Server Access Logs using SSE-KMS, the destination bucket's bucket policy must grant the S3 log delivery service permission to use the KMS key. This allows S3 to encrypt log objects with that key. Option C is correct. Option A is about denying unencrypted uploads to the source bucket, which does not affect log encryption. Option B enables default encryption on the source bucket, but logs are written to the destination bucket. Option D is about lifecycle policies, which do not control encryption.

Answer

Use an S3 bucket policy to deny unencrypted uploads to the source bucket

Answer

Enable default encryption on the source bucket

Answer

Configure the destination bucket with a lifecycle policy

Question 13

A company is designing a data protection strategy for Amazon EBS volumes. They want to automate the creation of point-in-time snapshots for all production volumes and retain them for 90 days. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use Amazon Data Lifecycle Manager (DLM) to create a policy that takes snapshots daily and retains them for 90 days. Amazon Data Lifecycle Manager (DLM) is the native AWS service designed to automate the creation and retention of EBS snapshots. It allows you to define policies for snapshot schedules (e.g., daily) and retention periods (e.g., 90 days) with minimal operational overhead. Option B is correct because DLM handles both creation and automated deletion based on the retention policy, eliminating the need for custom scripts or additional services. Option A requires managing a script and an EC2 instance, adding complexity. Option C adds unnecessary overhead with Lambda and CloudWatch. Option D, AWS Backup, can also manage EBS backups but is more suited for broader backup strategies and may involve more configuration; DLM is simpler for purely EBS snapshot automation.

Answer

Write a script using the AWS CLI that creates snapshots and runs on a schedule via cron on an EC2 instance

Answer

Use an AWS Lambda function triggered by CloudWatch Events to create snapshots and delete old ones

Answer

Use AWS Backup to create a backup plan for EBS volumes with a 90-day retention

Question 14

Refer to the exhibit. A security engineer is troubleshooting why an IAM user (Alice) cannot encrypt data using a KMS key. Alice has full S3 and KMS permissions via an IAM policy. The key policy is shown. Which statement explains the issue?

Accepted Answer

The key policy does not allow the IAM user to use the key for any action. The key policy does not grant Alice any permissions, and it does not enable IAM policies to allow access (no statement allowing root account to delegate via IAM). Since KMS requires explicit key policy authorization unless the key policy enables IAM policies, Alice cannot encrypt data even with full IAM permissions. Option D correctly identifies this. Option A is wrong because the key policy does not need a separate statement to allow IAM policies unless it explicitly enables IAM policy delegation. Option B is wrong because Alice has kms:Encrypt via IAM policy, but the key policy is restrictive. Option C is wrong because the root account is included (the Root principal).

Answer

The key policy is missing a statement to allow the IAM user to use the key via IAM policies

Answer

The IAM user does not have the kms:Encrypt permission in their IAM policy

Answer

The key policy does not include the root account principal

Question 15

A company wants to protect data in transit between an on-premises data center and Amazon S3. Which AWS service should be used to establish a dedicated, encrypted connection?

Accepted Answer

AWS Direct Connect with an IPsec VPN. AWS Direct Connect with IPsec VPN provides a dedicated private connection with encryption, ensuring data in transit is protected. Direct Connect alone (without VPN) is private but not encrypted by default; adding IPsec VPN over the Direct Connect link provides encryption. Option A is Direct Connect without VPN, which lacks encryption. Option B, AWS Transit Gateway, is a network transit hub, not a direct connection service. Option D, Site-to-Site VPN over the internet, uses the public internet and is not dedicated. Therefore, the correct answer is C.

Answer

AWS Direct Connect without VPN

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN over the internet