SCS-C02 Data Protection Practice Test 13 — 15 Questions

Question 1

A company wants to share an encrypted Amazon Machine Image (AMI) with another AWS account. The AMI uses an EBS snapshot encrypted with a customer managed key in KMS. What is the correct procedure to allow the other account to launch an EC2 instance from this AMI?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Share the AMI, share the snapshot, and grant the target account decrypt permissions on the KMS key.. An encrypted EBS snapshot backed by a customer managed KMS key requires three separate permissions to be shared: the AMI must be shared with the target account, the underlying snapshot must be shared (modify-snapshot-attribute), and the KMS key policy must grant the target account kms:Decrypt and kms:CreateGrant (and typically kms:DescribeKey). Without all three, the target account cannot launch an instance because it cannot decrypt the snapshot volumes.

Answer

Export the snapshot as an unencrypted snapshot and share it.

Answer

Share the AMI and have the target account create a new KMS key to encrypt the snapshot.

Answer

Share only the AMI; the snapshot permissions are inherited from the AMI.

Question 2

A company is using AWS DMS to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The data must be encrypted in transit. What should the company do?

Accepted Answer

Enable SSL on the source and target endpoints in the DMS task.. AWS DMS supports SSL/TLS to encrypt data in transit between source and target endpoints. Enabling SSL on both endpoints ensures that the data migration is encrypted over the network. Option A is incorrect because AWS Direct Connect provides a private network connection but does not automatically encrypt traffic; additional encryption like SSL is still required for data in transit. Option C is incorrect because AWS KMS is used for encryption at rest, not for encrypting data in transit. Option D is incorrect because a VPN connection provides a secure tunnel but is not necessary; DMS can use SSL directly on the endpoints, which is a simpler solution.

Answer

Use AWS Direct Connect to establish a private connection.

Answer

Use AWS KMS to encrypt the data before sending.

Answer

Set up a VPN connection between the on-premises network and AWS VPC.

Question 3

A company wants to ensure that data at rest in Amazon EBS volumes is encrypted. What is the simplest way to achieve this?

Accepted Answer

Enable EBS encryption by default in the AWS account.. The simplest way to ensure that data at rest in Amazon EBS volumes is encrypted is to enable EBS encryption by default in the AWS account. This setting automatically encrypts all new EBS volumes created in the account, using the default KMS key for EBS encryption. It eliminates the need to manually encrypt each volume or attach custom KMS keys. Other methods are more manual and do not provide the same level of automation.

Answer

Use AWS KMS to create a custom key and attach it to each volume.

Answer

Encrypt each volume manually using the AWS Management Console.

Answer

Use an operating system-level encryption tool like LUKS.

Question 4

A company wants to protect sensitive data stored in S3 from being accessed by unauthorized users. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use IAM policies to restrict access to the bucket.. Option A is correct because IAM policies define which principals (users, roles, groups) can perform which S3 actions (such as s3:GetObject or s3:PutObject) on specific bucket or object ARNs, directly controlling authorized access to sensitive data. Option D is correct because enabling S3 Block Public Access at the account level applies account-wide safeguards that reject bucket policies or ACLs granting public access, preventing accidental exposure of sensitive objects to anonymous users. Option B is not correct because S3 Versioning only preserves multiple object versions for recovery and does not by itself prevent unauthorized access. Option C is not correct because default encryption protects data at rest but does not stop an authorized-but-malicious or improperly permissioned principal from reading the data. Option E is not correct because MFA Delete only requires multi-factor authentication for permanently deleting object versions or changing versioning state, which is a deletion control rather than an access control.

Answer

Enable S3 Versioning.

Answer

Enable default encryption on all S3 buckets.

Answer

Enable MFA Delete on the bucket.

Question 5

The above CLI output shows the encryption configuration for an S3 bucket. What type of encryption is enabled by default?

Accepted Answer

SSE-S3. SSE-S3 (AES-256) is the default encryption applied by Amazon S3 when no explicit encryption configuration is set on a bucket. The CLI output showing 'ApplyServerSideEncryptionByDefault' with 'SSEAlgorithm: AES256' indicates SSE-S3, where S3 manages the keys entirely. SSE-KMS would show 'aws:kms' and a KMS key ARN, while SSE-C requires customer-provided keys per request.

Answer

SSE-C

Answer

Client-side encryption

Answer

SSE-KMS

Question 6

A company stores sensitive customer data in an S3 bucket. The security team wants to ensure that all data is encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Which bucket policy statement should be added to deny uploads that do not use SSE-KMS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}. The correct bucket policy statement uses a Deny effect on s3:PutObject with a condition that checks if the s3:x-amz-server-side-encryption header is not equal to 'aws:kms'. This ensures that any upload request that does not specify SSE-KMS with AWS KMS is denied. The condition StringNotEquals on that key enforces the requirement.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*"}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}

Question 7

A company uses AWS CloudHSM to generate and store encryption keys for a custom database. The security team needs to back up the keys to another AWS Region for disaster recovery. What is the most secure and efficient way to achieve this?

Accepted Answer

Create a backup of the source CloudHSM cluster and copy the backup to the destination Region.. AWS CloudHSM allows you to create a backup of a cluster and copy that backup to another region using the AWS CLI or console. This is the most secure method as it avoids exporting keys in plaintext. Option B is incorrect because CloudHSM does not support exporting keys directly; you must use backups. Option C is incorrect because CloudHSM does not have a cross-region replication feature for clusters. Option D is incorrect because copying keys via an on-premises HSM is unnecessary and less secure than using CloudHSM's built-in backup copy functionality.

Answer

Export the keys from the source CloudHSM cluster and import them into a destination cluster in the other Region.

Answer

Enable cross-Region replication on the CloudHSM cluster.

Answer

Use the key_mgmt_util command-line tool to copy the keys to an on-premises HSM, then upload to the destination Region.

Question 8

An application running on Amazon EC2 needs to access an S3 bucket containing sensitive data. The security team wants to avoid storing long-term AWS credentials on the instance. How should the EC2 instance be configured to access S3 securely?

Accepted Answer

Assign an IAM role with S3 permissions to the EC2 instance via an instance profile.. Assigning an IAM role to an EC2 instance via an instance profile is the AWS-recommended way to grant AWS service permissions without embedding long-term credentials. The instance profile delivers temporary, automatically rotated credentials through the EC2 Instance Metadata Service (IMDS) at 169.254.169.254, which the SDK/CLI retrieves transparently. This satisfies the security team's requirement to avoid storing long-term AWS credentials on the instance while still allowing least-privilege S3 access.

Answer

Store IAM user access keys in the instance's user data.

Answer

Attach a KMS key policy that allows the instance to decrypt S3 objects.

Answer

Generate S3 pre-signed URLs for all objects the instance needs to access.

Question 9

A company is designing a data encryption solution for its Amazon RDS for PostgreSQL database. The database must be encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Enable encryption when creating the RDS instance using a KMS key.. RDS supports encryption at rest for new databases using AWS KMS. Option B is incorrect because there is no separate encryption layer; RDS uses KMS. Option C is incorrect because application-level encryption is not the simplest. Option D is incorrect because RDS does not support CloudHSM for encryption at rest.

Answer

Enable AWS KMS encryption on the RDS instance after creation.

Answer

Use application-level encryption before inserting data into the database.

Answer

Use AWS CloudHSM to encrypt the EBS volumes attached to the RDS instance.

Question 10

A company uses AWS Secrets Manager to rotate secrets for its RDS database. The rotation fails periodically, and the security team needs to troubleshoot. Which CloudWatch metric should be monitored to detect rotation failures?

Accepted Answer

AWS/SecretsManager: SecretRotationSucceeded. The correct metric to monitor for Secrets Manager rotation failures is `AWS/SecretsManager:SecretRotationSucceeded`. When rotation fails, the `SecretRotationSucceeded` metric reports a value of 0, allowing the security team to set alarms. Option A is incorrect because KMS key usage metrics are not specific to rotation. Option C is incorrect because Lambda invocations may not capture all rotation failures and are not a direct indicator. Option D is incorrect because RDS metrics do not include Secrets Manager rotation status.

Answer

AWS/KMS: KeyUsage

Answer

AWS/Lambda: Invocations

Answer

AWS/RDS: DatabaseConnections

Question 11

A company wants to protect data in transit between its on-premises network and Amazon VPC using IPsec VPN. Which AWS service should be used to establish this VPN connection?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN is the service used to establish an IPsec VPN connection between an on-premises network and an Amazon VPC. It creates a secure tunnel over the internet using IPsec, terminating on a Virtual Private Gateway (VGW) or Transit Gateway on the AWS side and a Customer Gateway on the on-premises side.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 12

A company stores sensitive documents in an S3 bucket. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted using server-side encryption with AWS KMS. Which S3 bucket feature should be configured?

Accepted Answer

Default encryption. S3 default encryption (now called default encryption with SSE-KMS or SSE-S3) automatically encrypts every object at rest when it is uploaded, without requiring the uploader to specify encryption headers. Configuring default encryption with SSE-KMS using a customer-managed KMS key satisfies the requirement for automatic server-side encryption with AWS KMS. This is a bucket-level setting applied at PUT time.

Answer

Versioning

Answer

Bucket policy

Answer

Lifecycle policy

Question 13

A company is designing a data protection strategy for its Amazon S3 buckets. Which TWO actions can help protect data from accidental deletion or overwrite?

Accepted Answer

Enable MFA Delete on the bucket.. Option A (Enable MFA Delete on the bucket) is correct because MFA Delete requires multi-factor authentication to permanently delete an object version or to suspend or re-enable versioning, adding a strong safeguard against accidental or malicious deletion. Option D (Enable versioning on the bucket) is correct because versioning keeps multiple variants of an object in the same bucket, so an overwrite creates a new version and a delete only adds a delete marker, allowing the prior version to be restored. Together, versioning preserves prior object states and MFA Delete protects those versions from being permanently removed. Option B (Cross-Region Replication) is not correct here because it copies objects to another bucket for durability and compliance, but it does not by itself prevent deletion or overwrite in the source bucket. Option C (default encryption) protects data confidentiality at rest but does not stop deletion or overwrite. Option E (a lifecycle policy to expire objects) actually deletes objects, which is the opposite of protecting against accidental deletion.

Answer

Enable Cross-Region Replication.

Answer

Enable default encryption.

Answer

Set a lifecycle policy to expire objects.

Question 14

A company wants to ensure that all data transferred between its on-premises data center and AWS is encrypted in transit. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN encrypts data in transit between an on-premises network and AWS by establishing IPsec tunnels over the public internet, satisfying the requirement for encryption in transit. It uses IKE for key exchange and IPsec ESP for payload encryption, providing confidentiality and integrity for all traffic traversing the VPN connection. This is the standard AWS service for encrypted hybrid connectivity.

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 15

A company stores data in Amazon S3 and wants to ensure that objects are encrypted at rest. The security team decides to use server-side encryption with AWS KMS (SSE-KMS). Which additional benefit does SSE-KMS provide over SSE-S3?

Accepted Answer

Separate permissions for key usage and audit of key usage. SSE-KMS provides separate permissions for key usage and allows auditing of key usage via AWS CloudTrail. Option A is incorrect because both SSE-S3 and SSE-KMS use the same AES-256 encryption algorithm for encryption and decryption. Option B is incorrect because SSE-KMS incurs additional costs for KMS API calls, making it more expensive per object than SSE-S3. Option D is incorrect because both options use the same strong encryption algorithm (AES-256).

Answer

Faster encryption and decryption

Answer

Lower cost per object

Answer

Stronger encryption algorithm