SCS-C02 Data Protection Practice Test 12 — 15 Questions

Question 1

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects be encrypted with server-side encryption using customer-provided encryption keys (SSE-C). A developer uploads objects using the AWS SDK but forgets to include the encryption key in the request. What happens to the upload?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The upload succeeds but the object is stored without server-side encryption. With SSE-C, the request must include the encryption key. If not provided, the upload succeeds but the object is stored without server-side encryption (i.e., as plaintext). Option C is correct. Option A is wrong because S3 does not deny; B is wrong because no error; D is wrong because default encryption is not applied.

Answer

The upload succeeds and the object is encrypted with the default S3 managed key

Answer

The upload succeeds and the object is encrypted with the bucket's default encryption settings

Answer

The upload fails with a 400 Bad Request error

Question 2

Refer to the exhibit. A security engineer applies the bucket policy to an S3 bucket. A user uploads an object without specifying any encryption header. What happens?

Accepted Answer

The request is denied with an Access Denied error. The bucket policy denies PutObject if the encryption header is not 'aws:kms'. Since the user did not specify any encryption header, the condition 'aws:SecureTransport'? Actually, the policy condition likely checks 's3:x-amz-server-side-encryption' for 'aws:kms'. Without the header, the condition evaluates true (header is not 'aws:kms'), so the request is denied with Access Denied. Option C is correct. Option A is wrong because default encryption is not applied when the policy denies; B is wrong because the policy requires the header to be explicitly set; D is wrong because the policy denies the upload entirely.

Answer

The object is uploaded and encrypted with the bucket's default SSE-S3

Answer

The object is uploaded and encrypted with SSE-KMS

Answer

The object is uploaded without encryption

Question 3

A financial services company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application processes credit card numbers and stores them in an Amazon RDS for PostgreSQL database. The database is encrypted at rest using AWS KMS. The security team is concerned about data in transit between the ALB and EC2 instances, and between EC2 and RDS. They also want to ensure that the application never logs the full credit card number. The current setup: ALB terminates SSL using a certificate from AWS Certificate Manager (ACM). EC2 instances are in a private subnet. RDS is in a private subnet. The application logs to CloudWatch Logs. The security team reviews the logs and finds full credit card numbers in the logs. Which of the following actions should the security engineer take to address the data protection issues?

Accepted Answer

Modify the application to use TLS when connecting to RDS and update the application code to mask or truncate credit card numbers before logging. It directly addresses both issues: ensuring data in transit between EC2 and RDS uses TLS, and preventing credit card numbers from being logged by masking them in application code before logging. Option A only redacts logs after they are sent to CloudWatch, which is reactive and does not prevent the exposure in transit or in logs. Option B focuses on encryption at rest (already done) and SSL connections to RDS, but does not fix the logging issue. Option D suggests using HTTPS between ALB and EC2 and a self-signed certificate, but the ALB already terminates SSL; re-encrypting to EC2 would require instance-level certificate management and does not address logging.

Answer

Create a CloudWatch Logs subscription filter to redact credit card numbers from the logs after they are sent to CloudWatch

Answer

Enable RDS encryption with a new KMS key and enforce that all connections to RDS use SSL

Answer

Enable encryption in transit between the ALB and EC2 by using HTTPS listeners and configure the ALB to re-encrypt traffic to EC2 using a self-signed certificate on each instance

Question 4

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific IAM role can decrypt objects. What is the MOST secure way to achieve this?

Accepted Answer

Use a customer managed KMS key with a key policy that grants kms:Decrypt only to the specific IAM role, and configure the S3 bucket policy to allow only that role to access the bucket.. The most secure approach because it uses a customer managed KMS key with a key policy that grants kms:Decrypt only to the specific IAM role. Combined with an S3 bucket policy that restricts bucket access to that same role, this ensures that only the designated role can both access the S3 objects and decrypt them. Option B is incorrect because automatic key rotation does not control access permissions. Option C is incorrect because the S3 bucket policy alone cannot control decryption permissions; the KMS key policy is also required. Option D is incorrect because using an AWS managed key and S3 default encryption does not restrict decryption to a specific IAM role.

Answer

Enable automatic key rotation in KMS and assign the key to the IAM role.

Answer

Configure an S3 bucket policy that denies all users except the specific IAM role.

Answer

Use S3 default encryption with an AWS managed key and trust the IAM role.

Question 5

A company is designing a data protection strategy for its Amazon RDS for PostgreSQL database. The database contains sensitive customer data. Compliance requirements mandate that all backups be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance using a customer managed KMS key. Enable automatic key rotation in KMS.. Enabling encryption at rest on the RDS instance using a customer managed KMS key and enabling automatic key rotation in KMS provides annual key rotation, satisfying the compliance requirement. Option A is incorrect because an encrypted read replica inherits the source instance's encryption key and does not provide independent backup encryption or key rotation. Option B is incorrect because S3 server-side encryption is not relevant to RDS automated backups; RDS encrypts backups using the KMS key associated with the DB instance, and S3 lifecycle policies rotate objects, not encryption keys. Option C is incorrect because although an AWS managed KMS key encrypts the RDS instance and backups, its automatic key rotation occurs every three years, not annually as required.

Answer

Create an encrypted read replica of the RDS instance and use the replica for backups.

Answer

Use S3 server-side encryption with a customer managed key for automated backups. Configure lifecycle policies to rotate the key.

Answer

Enable encryption at rest on the RDS instance using an AWS managed KMS key. The key will be rotated automatically every year.

Question 6

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The application runs on Amazon EC2 instances and uses the PKCS#11 interface to interact with the HSM. The security team recently discovered that a former employee may have obtained a copy of the cryptographic materials from the HSM. What should the security team do to minimize the impact?

Accepted Answer

Delete the CloudHSM backup from the backup service. Then rotate all keys that were stored in the HSM.. Deleting the CloudHSM backup prevents the former employee from restoring the HSM's contents from a backup. Rotating all keys ensures that any keys the employee may have copied are no longer valid for encrypting/decrypting data, minimizing the impact of the exposure. Option A is incorrect because AWS KMS cannot manage keys stored in CloudHSM. Option C is incorrect because changing passwords does not invalidate cryptographic material that has already been copied. Option D is incorrect because deleting the HSM cluster alone does not delete the backup, and restoring from an old backup may reintroduce the compromised keys.

Answer

Use AWS KMS to create a new key and re-encrypt all data. Then revoke the old key.

Answer

Change the HSM administrator password and the crypto user passwords.

Answer

Delete the HSM cluster and create a new one. Restore the backup from a known good time.

Question 7

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that if a KMS key is disabled, all subsequent attempts to decrypt data encrypted with that key fail. What is the BEST way to achieve this?

Accepted Answer

Disable the KMS key.. Disabling a KMS key immediately prevents use of that key for decryption, so all subsequent decryption attempts fail. Option A is wrong because rotating a key does not affect the existing key's ability to decrypt data encrypted with it. Option B is wrong because revoking grants only removes permissions granted via grants; it does not affect the key policy or direct access, so decryption may still succeed. Option D is wrong because deleting a key is irreversible and can cause permanent data loss; disabling is sufficient and safer.

Answer

Rotate the KMS key immediately.

Answer

Revoke all grants associated with the KMS key.

Answer

Delete the KMS key.

Question 8

Which TWO of the following are valid methods to protect data in transit between an on-premises data center and AWS? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. Options B and E are correct. AWS Site-to-Site VPN creates an encrypted tunnel over the internet, protecting data in transit. AWS Direct Connect with MACsec provides encryption over a private physical connection. Option A is incorrect because CloudFront with HTTPS only encrypts between viewer and edge locations, not necessarily between the origin and edge, and it is not a method to connect on-premises directly to AWS. Option C is incorrect because VPC Peering does not encrypt traffic; it only routes between VPCs. Option D is incorrect because S3 Transfer Acceleration only speeds up transfers using edge locations but does not provide encryption.

Answer

Amazon CloudFront with HTTPS-only viewer protocol policy

Answer

VPC Peering

Answer

S3 Transfer Acceleration

Question 9

Which THREE of the following are required to use client-side encryption with Amazon S3 using AWS KMS? (Choose three.)

Accepted Answer

The encrypted data key is stored as metadata with the S3 object.. Options B, D, and E are correct. The client must call kms:GenerateDataKey (Option D) to obtain a data key, which is then used to encrypt the data. The encrypted data key is stored as metadata with the S3 object (Option B). The AWS SDK Encryption Client library (Option E) handles the client-side encryption process. Option A is wrong because an S3 bucket policy forcing encryption is not required for client-side encryption; that is used for server-side encryption enforcement. Option C is wrong because the KMS key policy does not need to allow the S3 service to decrypt; client-side encryption does not involve S3 decrypting the data.

Answer

An S3 bucket policy that forces encryption.

Answer

A KMS key policy that allows the S3 service to decrypt.

Question 10

Which TWO of the following are valid options for encrypting data at rest in Amazon EBS? (Choose two.)

Accepted Answer

Enable EBS encryption by default using the AWS managed key for EBS.. Options A and B are correct. EBS encryption can be enabled using either the AWS managed key for EBS (option A) or a customer managed KMS key (option B). Option C is incorrect because EBS encryption is not performed by a script on the EC2 instance; it is handled by AWS KMS. Option D is incorrect because CloudHSM is not directly used for EBS encryption (though it can be used as a key source via KMS custom key stores, it is not a direct option for encrypting EBS volumes). Option E is incorrect because S3 server-side encryption applies to objects in S3, not to EBS snapshots; EBS snapshots can be encrypted using KMS keys.

Answer

Use an encryption script on the EC2 instance to encrypt the volume.

Answer

Use AWS CloudHSM to generate and store the encryption key.

Answer

Use S3 server-side encryption to encrypt the EBS snapshot.

Question 11

Refer to the exhibit. An IAM policy allows kms:Decrypt on a specific KMS key only when the encryption context includes department=finance. A user attempts to decrypt an S3 object that was encrypted with the same KMS key but with encryption context department=hr. Will the decryption succeed?

Accepted Answer

No, because the encryption context does not match.. The IAM policy requires the encryption context to include department=finance for kms:Decrypt. Since the object was encrypted with department=hr, the encryption context does not match, and the decryption fails. Option B is incorrect because the key policy is not the issue; the IAM policy restricts based on encryption context. Option C is incorrect because while the user has kms:Decrypt permission on the key, the condition on that permission is not satisfied. Option D is incorrect because kms:DescribeKey permission is irrelevant to decryption; the condition on kms:Decrypt is not met.

Answer

No, because the key policy does not allow the user to decrypt.

Answer

Yes, because the user has kms:Decrypt permission on the key.

Answer

Yes, if the user also has kms:DescribeKey permission.

Question 12

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes credit card numbers and must comply with PCI DSS. The security team requires that all credit card numbers be encrypted at rest and in transit. The application stores the encrypted credit card numbers in Amazon RDS for MySQL. The RDS instance is encrypted at rest using AWS KMS. The application decrypts the credit card numbers after retrieval using a KMS key. The security team has noticed that some credit card numbers are being logged in plaintext in Amazon CloudWatch Logs by the application. The developers claim they are not logging the decrypted values. What is the MOST likely cause and solution?

Accepted Answer

Disable RDS audit logging or ensure that the query logs do not contain sensitive data.. The most likely cause is that RDS query logs (general logs or slow query logs) are enabled and sent to CloudWatch Logs. These logs capture SQL queries executed by the application. If the application sends the decrypted credit card numbers in SQL queries (e.g., in WHERE clauses or INSERT statements), the plaintext data gets logged in CloudWatch. Disabling RDS audit logging or configuring it to exclude sensitive data prevents this exposure. Option B is incorrect because preventing decryption via KMS policies would break application functionality. Option C is incorrect because the application is not logging the decrypted values; the logs are from RDS, not the application. Option D is incorrect because SSL/TLS encryption only protects data in transit and does not affect logging.

Answer

Use AWS KMS key policies to prevent the application from decrypting the credit card numbers.

Answer

Modify the application code to encrypt the credit card numbers before logging.

Answer

Enable SSL/TLS encryption for the connection between the application and RDS.

Question 13

A company is migrating its on-premises file server to Amazon EFS. The data includes sensitive financial records. The security team requires encryption at rest and in transit. The team plans to mount the EFS file system on EC2 instances using the NFS client. They have enabled encryption at rest on the EFS file system. However, they are unsure how to enforce encryption in transit. What should they do to ensure all data transferred between the EC2 instance and EFS is encrypted?

Accepted Answer

Mount the EFS file system using the `mount -t nfs4 -o tls` command on the EC2 instance.. To enforce encryption in transit for EFS, you must use the `mount` command with the `tls` option, which ensures the NFS client uses TLS encryption for all data transferred. Option B is incorrect because enabling encryption in transit in the EFS file system policy only allows encrypted connections; the client must explicitly request TLS via the mount option. Option C is incorrect because a VPN is not necessary for EFS encryption in transit and does not address the client configuration. Option D is incorrect because AWS Certificate Manager is not used for EFS encryption in transit; it is used for SSL/TLS certificates for other services like ALB or CloudFront.

Answer

Enable encryption in transit in the EFS file system policy and rely on the default NFS client behavior.

Answer

Set up a VPN connection between the VPC and the on-premises network to encrypt all traffic.

Answer

Use AWS Certificate Manager to issue a certificate for the EFS file system.

Question 14

A company runs a workload on Amazon EC2 that needs to access an Amazon S3 bucket to store sensitive data. The security team wants to ensure that the data is encrypted at rest in S3 without requiring any changes to the application. The application currently uses the AWS SDK to upload objects. Which solution meets the requirement with the LEAST operational overhead?

Accepted Answer

Enable S3 default encryption on the bucket using SSE-S3.. Enabling S3 default encryption ensures all objects uploaded to the bucket are encrypted at rest using SSE-S3 without requiring any application changes. The application can continue using the AWS SDK normally; the bucket automatically applies encryption. Option A is incorrect because a bucket policy denying unencrypted uploads forces the application to include encryption headers, requiring changes. Option B is incorrect as client-side encryption requires code modifications. Option D is incorrect because a KMS key policy does not enforce encryption on the bucket; it only manages key access.

Answer

Configure an S3 bucket policy that denies uploads without encryption.

Answer

Modify the application to use client-side encryption with KMS.

Answer

Use a KMS key policy to require encryption for the bucket.

Question 15

A company uses AWS KMS to encrypt data in Amazon DynamoDB. The table has a TTL attribute that triggers automatic deletion of expired items. The security team is concerned that deleted items may still be recoverable. What should the team do to ensure that deleted items are cryptographically erased and cannot be recovered?

Accepted Answer

Delete the KMS customer master key (CMK) used to encrypt the table after verifying no other data depends on it.. To cryptographically erase data, you must delete the KMS key that was used to encrypt it. However, deleting a KMS key is irreversible and may affect other data. Option B is wrong because disabling the key prevents decryption, but the encrypted data still exists. Option C is wrong because the TTL deletion does not encrypt the data. Option D is wrong because DynamoDB backups are separate; you need to delete the key or the data.

Answer

Disable the KMS key to prevent decryption of deleted items.

Answer

Configure DynamoDB TTL to encrypt the items before deletion.

Answer

Create a backup of the table and then delete the table.