SCS-C02 Data Protection Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. The engineer attempts to upload a file using the AWS CLI without specifying any encryption. What is the outcome?

Accepted Answer

The upload fails because the policy denies PutObject when encryption is not SSE-KMS.. Option B is correct because the bucket policy denies PutObject if the encryption is not SSE-KMS. If the upload does not specify encryption, the encryption header is not set, so the condition StringNotEquals evaluates to true (since no encryption is not equal to 'aws:kms'), and the upload is denied. Option A is wrong because default encryption is not enabled. Option C is wrong because SSE-S3 is also denied. Option D is wrong because the policy does not allow unencrypted uploads.

Answer

The upload fails because the policy denies all PutObject requests.

Answer

The upload succeeds because default encryption on the bucket will encrypt the object with SSE-S3.

Answer

The upload succeeds because the object is encrypted with SSE-S3 by default.

Question 2

Refer to the exhibit. A user named John encrypts a file using the AWS CLI. John then tries to decrypt the file but receives an AccessDenied error. John has full administrator permissions in IAM. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant John the kms:Decrypt permission.. Option B is correct because the key policy controls access to the KMS key. Even with full admin permissions in IAM, if the key policy does not grant the user decrypt permission, the request fails. Option A is wrong because the ciphertext is not malformed; the encryption succeeded. Option C is wrong because IAM permissions are not enough; key policy must allow. Option D is wrong because the error is about decrypt, not about key existence.

Answer

The ciphertext blob is malformed because it was not base64-decoded before decryption.

Answer

John's IAM policy denies the kms:Decrypt action.

Answer

The key ID used for encryption is different from the key used for decryption.

Question 3

Refer to the exhibit. A security engineer reviews the bucket policy for an S3 bucket. The engineer attempts to upload an object to the bucket using the AWS CLI without the --ssl flag (HTTP). What is the outcome?

Accepted Answer

The upload fails because the policy denies requests that are not using HTTPS.. Option C is correct because the bucket policy denies all s3 actions if the request is not using HTTPS (SecureTransport is false). Since the engineer uses HTTP (no SSL), the condition matches and the upload is denied. Option A is wrong because the bucket does not have a default encryption setting. Option B is wrong because the policy denies all actions, not just put. Option D is wrong because the policy denies, not allows.

Answer

The upload succeeds because the policy allows all actions.

Answer

The upload succeeds because the bucket has default encryption enabled.

Answer

The upload fails because the policy denies s3:PutObject only.

Question 4

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They must manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys and manage rotation. SSE-S3 uses AWS-managed keys (no customer control). SSE-KMS uses KMS keys but AWS manages rotation unless using customer-managed keys with automatic rotation. Option C is correct because SSE-C gives full control over key management and rotation.

Answer

SSE-S3

Answer

SSE-KMS with AWS managed key

Answer

Client-side encryption

Question 5

A security engineer needs to ensure that all data in transit between an Application Load Balancer and EC2 instances is encrypted using TLS. Which configuration is required?

Accepted Answer

Configure the ALB with an HTTPS listener and the target group with HTTPS protocol.. The ALB must have a listener with a secure listener protocol (HTTPS) and the target group must specify HTTPS as the protocol to enable encryption between ALB and EC2 instances. Option B is correct.

Answer

Configure the ALB with an HTTPS listener and the target group with HTTP protocol.

Answer

Configure the ALB with a TLS listener and the target group with TCP protocol.

Answer

Configure the ALB with a TCP listener and the target group with HTTP protocol.

Question 6

A company uses AWS KMS to encrypt data in Amazon S3. They need to audit all KMS key usage for an S3 bucket. Which AWS service should be used to capture KMS Decrypt API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures API calls to AWS services, including KMS Decrypt. CloudTrail logs can be delivered to S3 for analysis. Option C is correct. CloudWatch Logs can receive logs but does not directly capture KMS API calls; S3 server access logs do not include KMS decryption events; VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon S3 server access logs

Answer

Amazon VPC Flow Logs

Answer

AWS CloudWatch Logs

Question 7

A company stores sensitive data in Amazon S3 and requires that objects are automatically encrypted using server-side encryption with AWS KMS. The bucket policy must deny any PUT request that does not include the x-amz-server-side-encryption header with value aws:kms. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The condition key s3:x-amz-server-side-encryption can be used to check the header value. Condition key aws:SourceIp is for source IP; aws:RequestedRegion is for region; kms:EncryptionContext is for KMS encryption context. Option A is correct.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

kms:EncryptionContext

Question 8

A company wants to protect data in transit between an on-premises data center and AWS over the internet. Which AWS service should they use to create a dedicated, encrypted connection?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN provides an encrypted tunnel over the internet between on-premises and AWS. AWS Direct Connect provides a dedicated connection but is not encrypted by default; IPsec can be added. AWS Transit Gateway is a network transit hub, not a connection type. AWS Client VPN is for individual clients. Option B is correct.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Answer

AWS Client VPN

Question 9

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

Accepted Answer

The bucket policy does not include the aws:SourceVpce condition.. When using a VPC endpoint, the S3 bucket policy must include the condition aws:SourceVpce to allow access from the specific endpoint. If the condition is missing or incorrect, access is denied even if the IAM role allows it. Option C is correct. The IAM role being incorrect would cause a different error; the endpoint policy might override but the bucket policy is the primary issue; the security group might block network access but the error is AccessDenied from S3, not network timeout.

Answer

The IAM role does not have sufficient permissions.

Answer

The VPC endpoint policy is blocking the request.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Question 10

A company uses AWS KMS to encrypt data in Amazon RDS. The security team needs to ensure that the KMS key cannot be deleted accidentally. Which action should be taken?

Accepted Answer

Add a statement to the key policy that denies the kms:ScheduleKeyDeletion action.. KMS key deletion can be prevented by enabling key rotation (does not prevent deletion), using an alias (does not prevent deletion), or enabling deletion protection via a key policy (not directly; deletion requires a waiting period). The correct approach is to set a deletion window and ensure the key is not scheduled for deletion, but the question asks for accidental deletion prevention. Enabling automatic key rotation does not prevent deletion. The best answer is to use a multi-Region key? No. Actually, to prevent accidental deletion, you can use a KMS key policy that denies the ScheduleKeyDeletion action. Option D is correct: the key policy should include a Deny statement for kms:ScheduleKeyDeletion.

Answer

Create an alias for the key.

Answer

Enable automatic key rotation.

Answer

Use a multi-Region key.

Question 11

A company has an S3 bucket with versioning enabled. They want to ensure that all deleted objects are retained for 90 days before permanent deletion. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policy with NoncurrentVersionExpiration. S3 Object Lock with retention mode Compliance or Governance can protect objects from deletion, but the question asks for a retention period after deletion. S3 Lifecycle policies can expire current versions after a period, but for deleted objects (noncurrent versions), a lifecycle rule with NoncurrentVersionExpiration can delete them after a specified number of days. Option B is correct. S3 Replication is for copying objects; MFA Delete adds an extra layer but does not set a retention period.

Answer

S3 Replication

Answer

S3 Object Lock

Answer

MFA Delete

Question 12

A company needs to encrypt data at rest in Amazon EBS volumes. They want to use an AWS managed key that is automatically rotated. Which encryption option should they choose?

Accepted Answer

Enable EBS encryption by default using the AWS managed key for Amazon EBS.. Option B is correct because enabling EBS encryption by default using the AWS managed key for Amazon EBS (alias `aws/ebs`) ensures data at rest is encrypted with a key that is automatically rotated on an annual basis, as required. This key is managed by AWS and requires no manual intervention for rotation, meeting the company's need for a managed, automatically rotated key.

Answer

Use SSE-S3.

Answer

Use a customer-managed KMS key with automatic rotation enabled.

Answer

Use client-side encryption.

Question 13

A security engineer is designing a data protection strategy for Amazon RDS for PostgreSQL. The database contains sensitive personal information. Which TWO actions should the engineer take to protect the data at rest? (Choose TWO.)

Accepted Answer

Enable encryption at rest for the RDS instance using AWS KMS.. Enabling encryption at rest for RDS (Option A) and enabling automated backups with encryption (Option D) ensure data at rest is encrypted. Deleting backups (Option B) does not protect data at rest. Enabling encryption in transit (Option C) protects data in motion. Enabling deletion protection (Option E) prevents accidental deletion but does not encrypt data.

Answer

Enable SSL/TLS for connections to the database.

Answer

Delete automated backups after 30 days.

Answer

Enable deletion protection for the RDS instance.

Question 14

A company uses AWS KMS to encrypt sensitive data. The security team wants to ensure that KMS keys are not used by unauthorized principals. Which TWO measures should be implemented? (Choose TWO.)

Accepted Answer

Define a key policy that grants kms:Encrypt and kms:Decrypt only to specific IAM roles.. Using key policies to restrict which IAM roles can use the key (Option A) and enabling key rotation to limit the window of compromise (Option D) are effective. Granting broad access (Option B) is not recommended. Deleting unused keys (Option C) does not prevent unauthorized use of remaining keys. Using aliases (Option E) does not control access.

Answer

Delete any KMS keys that are not used for more than 90 days.

Answer

Create aliases for frequently used keys.

Answer

Grant kms:* permissions to all IAM users in the account.

Question 15

A company is designing a data protection solution for Amazon S3. They need to ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Enable default encryption on the S3 bucket with SSE-S3 or SSE-KMS.. Enabling S3 default encryption (Option A) ensures new objects are encrypted. Using a bucket policy to deny PutObject without encryption headers (Option C) enforces encryption. Enabling S3 Block Public Access (Option B) prevents public access but not unencrypted uploads. Enabling MFA Delete (Option D) adds authentication for deletes. Enabling versioning (Option E) does not enforce encryption.

Answer

Enable versioning on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Enable S3 Block Public Access settings.

SCS-C02 Data Protection Practice Test 13 — 15 Questions

Exhibit

SCS-C02 Data Protection Practice Test 13 — 15 Questions

Exhibit