SCS-C02 Data Protection Practice Test 12 — 15 Questions

Question 1

A company wants to ensure that data stored in Amazon S3 is encrypted at rest using keys managed by AWS. Which encryption option should they choose?

Accepted Answer

Server-side encryption with S3 managed keys (SSE-S3).. SSE-S3 uses AES-256 encryption keys managed entirely by AWS, fulfilling the requirement for encryption at rest with AWS-managed keys. When you upload an object, S3 encrypts it before writing to disk and decrypts it when you access it, all without any customer action or key management overhead.

Answer

Client-side encryption.

Answer

Server-side encryption with AWS KMS (SSE-KMS).

Answer

Server-side encryption with customer-provided keys (SSE-C).

Question 2

A company needs to enforce encryption in transit for all traffic between an Amazon EC2 instance and an Amazon RDS database. Which TWO steps should be taken?

Accepted Answer

Enable TLS on the RDS database and configure the database to require encrypted connections.. Option A is correct because enforcing encryption in transit for RDS requires enabling TLS on the DB instance and setting the parameter group so the database requires SSL/TLS connections (for example, MySQL's require_secure_transport or PostgreSQL's rds.force_ssl), which rejects unencrypted client sessions. Option E is correct because the client side must actually negotiate TLS: the application on the EC2 instance has to connect using SSL/TLS, typically by supplying the RDS CA certificate (rds-ca-rsa2048-g1 or similar) and using the appropriate driver parameters such as sslmode=require for PostgreSQL or ssl-mode=REQUIRED for MySQL. Option B is not correct because security groups only control network reachability on ports 3306/5432 and do not provide or enforce encryption. Option C is not correct because a VPN encrypts traffic at the network layer between networks but is not the mechanism used to enforce TLS between an EC2 instance and an RDS endpoint, and RDS TLS is the supported approach. Option D is not correct because encryption at rest protects stored data via KMS and does not address data in transit between the EC2 instance and the database.

Answer

Configure security groups to allow traffic only on port 3306 (MySQL) or 5432 (PostgreSQL).

Answer

Set up a VPN connection between the EC2 instance and the RDS database.

Answer

Enable encryption at rest on the RDS instance.

Question 3

A security engineer applies the above S3 bucket policy. An application tries to upload an object with the header "x-amz-server-side-encryption: AES256". What will happen?

Accepted Answer

The upload fails because the encryption header does not match 'aws:kms'.. The bucket policy explicitly requires the condition that the encryption header equals 'aws:kms', which enforces SSE-KMS. When the application sends 'x-amz-server-side-encryption: AES256' (which requests SSE-S3), the request does not satisfy the policy condition, so S3 denies the upload with an AccessDenied error. The policy's condition is a hard gate, not a preference.

Answer

The upload succeeds because the policy allows SSE-S3.

Answer

The upload succeeds because the object is encrypted.

Answer

The upload fails because the header is missing.

Question 4

A company has an S3 bucket with versioning and MFA Delete enabled. A user attempts to delete an object version using the AWS CLI without MFA. What will happen?

Accepted Answer

The request fails with an AccessDenied error.. When MFA Delete is enabled on an S3 bucket, any request to permanently delete an object version or to change the versioning state of the bucket must include a valid MFA token. If a user attempts to delete an object version without MFA, the request fails with an AccessDenied error. This is the expected behavior to protect against accidental or malicious deletions.

Answer

The object version is marked for deletion and will be deleted after 30 days.

Answer

The object version is deleted and a delete marker is created.

Answer

The object version is deleted but not permanently.

Question 5

A company is designing a data protection strategy for sensitive data stored in Amazon S3. Compliance requirements mandate that all data be encrypted at rest using customer-provided keys (SSE-C). Which solution meets the requirements with minimal operational overhead?

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C) and store the keys in AWS Secrets Manager.. Server-side encryption with customer-provided keys (SSE-C) allows the customer to supply their own encryption keys while AWS manages the encryption/decryption process, meeting compliance requirements with minimal operational overhead. Storing the keys in AWS Secrets Manager adds convenience and security. Option A is incorrect because SSE-S3 uses AWS-managed keys, not customer-provided keys. Option B is incorrect because client-side encryption with the AWS Encryption SDK requires the application to handle encryption, increasing overhead and complexity, and it does not use SSE-C. Option D is incorrect because SSE-KMS uses AWS KMS managed keys, not customer-provided keys, even if key rotation is enabled.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3) and enable bucket versioning.

Answer

Use client-side encryption with the AWS Encryption SDK and store keys in the application configuration.

Answer

Use server-side encryption with AWS KMS managed keys (SSE-KMS) and enable automatic key rotation.

Question 6

A security engineer needs to ensure that data at rest in an Amazon RDS for PostgreSQL DB instance is encrypted. Which action should the engineer take?

Accepted Answer

Create a new DB instance with encryption enabled using the AWS CLI or Console.. Amazon RDS does not support enabling encryption on an existing unencrypted DB instance; encryption must be specified at creation time. To encrypt data at rest, the engineer must create a new DB instance with encryption enabled (via Console, CLI, or API), then migrate data from the old instance. This is the only supported path for RDS encryption at rest.

Answer

Grant the rds:ModifyDBInstance permission to allow encryption toggling.

Answer

Modify the existing unencrypted DB instance to enable encryption.

Answer

Enable encryption automatically by enabling automated backups.

Question 7

A company is implementing a data loss prevention (DLP) solution for data stored in Amazon S3. The data includes personally identifiable information (PII). The company wants to automatically identify and classify PII objects, then apply encryption using AWS KMS with a customer-managed key. Which AWS service should be used to identify PII?

Accepted Answer

Amazon Macie. Amazon Macie is the correct service because it uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as PII in Amazon S3. AWS CloudTrail (Option A) logs API calls and does not inspect data content. Amazon GuardDuty (Option C) detects threats and unauthorized behavior, not data classification. AWS Config (Option D) evaluates resource configurations and compliance, not data content. Therefore, Option B is correct.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 8

A security engineer needs to protect data in transit between an EC2 instance and an RDS database. The RDS database uses SSL/TLS certificates. What is the MOST secure way to ensure that the connection is encrypted?

Accepted Answer

Download the RDS CA certificate to the EC2 instance and configure the database client to use SSL and verify the certificate.. It ensures both encryption and server authentication. Downloading the RDS CA certificate (the trusted root for the RDS instance's server certificate) and configuring the client to verify it prevents man-in-the-middle attacks by confirming the RDS endpoint's identity. Simply enabling SSL without verification (as in other options) leaves the connection vulnerable to spoofing, so this is the most secure approach.

Answer

Configure the EC2 instance to use a self-signed certificate for SSL connections.

Answer

Enable encryption at rest on the RDS instance to automatically encrypt in-transit traffic.

Answer

Create an IAM policy that requires SSL connections to the RDS endpoint.

Question 9

A company needs to securely store database credentials that are used by an application running on Amazon EC2. The credentials must be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing, retrieving, and automatically rotating database credentials. It natively supports rotation for Amazon RDS, Aurora, and other databases via Lambda rotation functions, and can rotate credentials every 90 days as required. This directly meets the requirement for secure storage and automatic rotation.

Answer

AWS KMS

Answer

AWS IAM roles for EC2

Answer

AWS Systems Manager Parameter Store

Question 10

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects be encrypted using server-side encryption with customer-provided keys (SSE-C). An application fails when trying to read an object with the error 'The request includes an invalid header.' What is the MOST likely cause?

Accepted Answer

The application did not include the x-amz-server-side-encryption-customer-key header in the GET request.. With SSE-C, the customer provides the encryption key on every request, and S3 does not store it. For a GET request, the client must include the same key headers used during PUT: x-amz-server-side-encryption-customer-algorithm, x-amz-server-side-encryption-customer-key, and x-amz-server-side-encryption-customer-key-MD5. If the key header is missing, S3 returns an 'invalid header' error because it cannot decrypt the object.

Answer

The application did not specify an encryption context in the request.

Answer

The KMS key used for encryption has been disabled.

Answer

The S3 bucket does not have versioning enabled.

Question 11

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its targets. Which configuration should be used?

Accepted Answer

Configure the ALB with an HTTPS listener and use HTTPS as the protocol for the target group.. To encrypt data in transit between an ALB and its targets, you must configure the ALB listener to use HTTPS and set the target group protocol to HTTPS. This ensures that traffic from the ALB to the targets is encrypted using TLS. The ALB terminates the client-side TLS and establishes a new TLS connection to the targets.

Answer

Configure the ALB with a TCP listener and use Network Load Balancer.

Answer

Configure the ALB security group to allow only encrypted traffic.

Answer

Configure the ALB with an HTTP listener and use a security group to enforce encryption.

Question 12

Which TWO methods can be used to encrypt data at rest in Amazon S3? (Choose 2.)

Accepted Answer

Use SSE-S3 to have Amazon S3 manage the encryption keys.. Option B is correct because SSE-S3 (server-side encryption with Amazon S3-managed keys, AES-256) encrypts objects at rest, with AWS fully managing the key material and rotation. Option E is correct because client-side encryption means data is encrypted before it leaves the client and is stored in S3 already encrypted, so the objects are protected at rest. Option A is not a valid answer because a bucket policy denying unencrypted uploads only enforces that encryption is used; it does not itself encrypt data. Option C is incorrect because HTTPS/TLS provides encryption in transit, not at rest. Option D is incorrect because MFA Delete only adds an authentication requirement for deleting objects or changing versioning state; it does not encrypt data.

Answer

Set a bucket policy that denies uploads without encryption.

Answer

Enable encryption in transit using HTTPS.

Answer

Enable MFA Delete on the S3 bucket.

Question 13

A company uses S3 to store sensitive customer data. They want to ensure that all S3 buckets have encryption enabled at rest. Which S3 feature should be used to automatically enforce encryption on all newly created objects?

Accepted Answer

S3 Bucket Policy with a condition requiring server-side encryption. An S3 bucket policy with a condition requiring server-side encryption (e.g., 's3:x-amz-server-side-encryption': 'aws:kms' or 'AES256') can deny any PutObject request that does not include the encryption header, thereby automatically enforcing encryption on all newly created objects. Option A is incorrect because S3 Block Public Access controls public access, not encryption. Option B is incorrect because S3 Object Lock is for write-once-read-many (WORM) retention, not encryption enforcement. Option D is incorrect because S3 Inventory provides a list of objects and their metadata but does not enforce encryption.

Answer

S3 Block Public Access

Answer

S3 Object Lock

Answer

S3 Inventory

Question 14

A security engineer needs to ensure that an Amazon RDS for MySQL database is encrypted at rest. Which action should be taken?

Accepted Answer

Create a new DB instance with encryption enabled.. Amazon RDS does not support enabling encryption on an existing unencrypted DB instance. Encryption at rest must be configured at instance creation time by selecting the KMS key. Therefore, the only valid path is to create a new DB instance with encryption enabled and migrate data to it.

Answer

Use a client-side encryption tool to encrypt data before writing to the database.

Answer

Use AWS KMS to encrypt individual databases within the instance.

Answer

Enable encryption on an existing unencrypted DB instance.

Question 15

A company uses AWS KMS to manage encryption keys for sensitive data stored in S3. The security team wants to ensure that keys are rotated automatically every year. What should they do?

Accepted Answer

Enable automatic key rotation on a customer managed key.. Automatic key rotation is a native feature of AWS KMS customer managed keys (CMKs). Enabling it causes KMS to generate new backing key material every year (or a custom period of 90-2560 days) while retaining the same key ID, so existing ciphertext remains decryptable without re-encryption. This satisfies the 'rotate automatically every year' requirement with no manual intervention.

Answer

Use a custom key store and rotate keys manually.

Answer

Use a CloudHSM to store keys and rotate them manually.

Answer

Use an AWS managed key, which rotates automatically every year.