SCS-C02 Data Protection Practice Test 13 — 15 Questions

Question 1

Which THREE actions are required to enforce encryption in transit for an Amazon S3 bucket? (Choose 3.)

Accepted Answer

Add a bucket policy that denies requests with aws:SecureTransport set to false.. Adding a bucket policy that denies requests with `aws:SecureTransport` set to `false` explicitly blocks any HTTP (non-HTTPS) requests to the S3 bucket. This condition key evaluates the transport protocol used for the request, and when set to deny, it ensures that only encrypted connections (HTTPS) are allowed, enforcing encryption in transit.

Answer

Enable default encryption on the bucket.

Answer

Use an IAM policy to restrict access to the bucket.

Question 2

A security engineer runs the command shown in the exhibit. What is the primary purpose of this command?

Accepted Answer

To encrypt the contents of secret.txt using a KMS key and store the result in encrypted_secret.txt.. The command uses the AWS KMS encrypt API to encrypt the contents of secret.txt with a KMS key. It then extracts the base64-encoded ciphertext blob and decodes it to write the raw encrypted output to encrypted_secret.txt. Option A describes generating a data key without plaintext, which uses the GenerateDataKey API. Option B describes re-encryption, which uses the ReEncrypt API. Option C describes decryption, which uses the Decrypt API. Therefore, only option D accurately describes the command's purpose.

Answer

To generate a data key without plaintext.

Answer

To re-encrypt an existing encrypted file under a new key.

Answer

To decrypt the file secret.txt using a KMS key.

Question 3

A security engineer applies the bucket policy shown in the exhibit to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows uploads only if they use SSE-KMS.. The bucket policy includes a Deny statement that restricts uploads based on encryption headers. Specifically, it denies requests where the x-amz-server-side-encryption header is not set to 'aws:kms' or where the x-amz-server-side-encryption-aws-kms-key-id is missing. This effectively allows only uploads that use SSE-KMS. Therefore, Option D is correct.

Answer

Allows uploads only if they use SSE-S3.

Answer

Allows uploads without encryption.

Answer

Allows uploads with any server-side encryption.

Question 4

A security engineer is designing a solution to protect sensitive data in an Amazon RDS for MySQL database. The data must be encrypted at rest using a key stored in AWS KMS. Additionally, the database must support automated backups and cross-region disaster recovery. Which architecture meets these requirements?

Accepted Answer

Launch an encrypted RDS instance using a customer-managed KMS key. Enable automated backups and create a cross-region read replica.. Meets all requirements: launching an encrypted RDS instance with a customer-managed KMS key enables encryption at rest, automated backups are encrypted automatically, and cross-region read replicas are supported from encrypted sources (though the replica must use the same KMS key or a replica key in the destination region). Option A is incorrect because migrating with DMS does not provide native encryption at rest for the source. Option B is incorrect because you cannot enable encryption on an existing RDS instance; a new encrypted instance must be created. Option C is incorrect because exporting to S3 is not necessary and does not replace native encryption and cross-region replica capabilities.

Answer

Launch an unencrypted RDS instance, then use AWS DMS to replicate data to an encrypted instance in another region.

Answer

Launch an unencrypted RDS instance, then enable encryption using the AWS Console after creation.

Answer

Launch an encrypted RDS instance using the default KMS key, then export the database to S3 and copy to another region.

Question 5

A company uses Amazon S3 to store sensitive documents. The security team wants to ensure that all objects are encrypted at rest using server-side encryption. Additionally, any attempt to upload an unencrypted object must be denied. What should the security team do?

Accepted Answer

Add an S3 bucket policy that denies PutObject if the object is not encrypted using SSE-S3 or SSE-KMS.. An S3 bucket policy that denies PutObject if the object is not encrypted using SSE-S3 or SSE-KMS ensures that any upload attempt without proper server-side encryption is blocked. Option A is incorrect because enabling default encryption does not deny unencrypted uploads if the request explicitly sets encryption to none. Option B is incorrect because the 's3:x-amz-server-side-encryption' condition key can require encryption but does not cover all cases; using a deny statement for unencrypted uploads is more robust. Option D is incorrect because AWS Config can only detect non-compliance, not deny the upload in real-time.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Add an S3 bucket policy that requires encryption using the 's3:x-amz-server-side-encryption' condition key.

Answer

Create an AWS Config rule to detect unencrypted objects and trigger a Lambda function to encrypt them.

Question 6

A company wants to securely share an Amazon S3 object with an external partner. The partner needs to download the object using an HTTP GET request. The object must be accessible for only 24 hours. What is the most secure way to grant access?

Accepted Answer

Generate a presigned URL for the object with an expiration of 24 hours.. A presigned URL grants time-limited, secure access to a specific S3 object without exposing AWS credentials. The partner can download the object via HTTP GET within the 24-hour expiration window. Option A is incorrect because sharing IAM user credentials is insecure and provides broader access than needed. Option B is incorrect because making the object public exposes it to anyone, violating security. Option D is incorrect because creating an IAM user is unnecessary; the presigned URL alone provides the required access, and adding a user credential undermines security.

Answer

Create a new IAM user with read access to the object and share the access key and secret key.

Answer

Make the object publicly readable and share the object URL.

Answer

Create a new IAM user with read access to the object, then generate a presigned URL for the object.

Question 7

A company stores sensitive data in an Amazon S3 bucket. The security team requires that all data in transit between the company's on-premises data center and S3 be encrypted. Which solution meets this requirement?

Accepted Answer

Use HTTPS (TLS) endpoints when uploading objects to S3.. Using HTTPS (TLS) ensures encryption of data in transit between the client and S3. Option A is incorrect because although an IPsec VPN encrypts traffic between the data center and AWS, the data is then decrypted and sent to S3, so it does not guarantee encryption for the entire path unless S3 is accessed via HTTPS as well. Option B is incorrect because S3 Transfer Acceleration speeds up transfers using edge locations but does not provide encryption; HTTPS is still required. Option D is incorrect because a VPC endpoint for S3 provides private connectivity but does not encrypt traffic; encryption still relies on HTTPS.

Answer

Set up an IPsec VPN connection between the data center and AWS, and access S3 through the VPN.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use AWS PrivateLink to create a VPC endpoint for S3.

Question 8

A company uses AWS KMS to encrypt data in Amazon S3. The security team notices that a KMS key has been deleted accidentally, causing data loss. The company wants to implement a solution to prevent accidental key deletion and enable recovery. What should the security team do?

Accepted Answer

Create a multi-Region key and enable automatic key rotation.. Creating a multi-Region key replicates the key material to another AWS Region, providing a backup that can be used if the primary key is accidentally deleted. Enabling automatic key rotation further enhances security by regularly rotating the backing keys, but it does not prevent deletion. However, the multi-Region key approach allows recovery from accidental deletion by using the replica in another Region. Option A is incorrect because disabling the key only prevents its use, not its deletion; the deletion waiting period allows recovery only if the deletion is canceled within the waiting period. Option B is incorrect because automatic key rotation does not prevent deletion; it only creates new cryptographic material. Option D is incorrect because AWS CloudHSM does not directly integrate with S3 server-side encryption using KMS (SSE-KMS) for automatic encryption; it requires custom applications.

Answer

Enable the key's 'Disable key' option and set a deletion waiting period of 7 days.

Answer

Enable automatic key rotation for the KMS key.

Answer

Use AWS CloudHSM to store the key material and create a backup in another Region.

Question 9

A company is migrating sensitive data to Amazon S3. The data must be encrypted at rest using keys managed by the company. The company also requires an audit trail of key usage. Which solution meets these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed key and enable CloudTrail for KMS.. SSE-KMS with a customer-managed key and CloudTrail for KMS. This solution meets both requirements: the company manages its own keys (customer-managed CMK) and CloudTrail logs every KMS API call, providing an audit trail of key usage. Option A (SSE-S3) uses Amazon-managed keys, so no customer control or audit trail. Option B (SSE-C) requires the customer to manage keys themselves but does not integrate with CloudTrail for key usage auditing; also, storing keys in Secrets Manager does not provide an audit trail of KMS key usage. Option D (CloudHSM) can be used, but it requires more complex setup for auditing; SSE-KMS with CloudTrail is the simpler and more direct solution.

Answer

Use SSE-S3 with default encryption.

Answer

Use SSE-C and store the keys in AWS Secrets Manager.

Answer

Use AWS CloudHSM to generate and store keys, and use Amazon S3 with SSE-KMS.

Question 10

A company's security policy requires that all data stored in Amazon S3 be encrypted using envelope encryption with a key hierarchy. The master key must be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated. Which solution should the company implement?

Accepted Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.. AWS KMS with a custom key store backed by AWS CloudHSM provides envelope encryption with a key hierarchy, and CloudHSM is FIPS 140-2 Level 3 validated. Option B is wrong because the default KMS key store uses FIPS 140-2 Level 2 validated HSMs, not Level 3. Option C is wrong because SSE-S3 uses server-side encryption with S3-managed keys and does not provide envelope encryption or a key hierarchy. Option D is wrong because while CloudHSM provides the HSM, you would need to implement envelope encryption yourself, and the requirement specifies using a key hierarchy, which KMS provides natively.

Answer

Use AWS KMS with the default KMS key store.

Answer

Use Amazon S3 with SSE-S3 and enable default encryption.

Answer

Use AWS CloudHSM to generate a master key and implement envelope encryption in the application.

Question 11

A company needs to encrypt data at rest for an Amazon RDS for Oracle database. The database is deployed in a Multi-AZ configuration. The company also wants to encrypt automated backups and snapshots. Which TWO steps should the security team take?

Accepted Answer

Enable encryption at rest when launching the RDS instance.. Encryption must be enabled at launch; it cannot be added later. Option C is correct because enabling encryption at rest automatically encrypts backups and snapshots. Option B is wrong because encryption cannot be enabled on an existing unencrypted instance. Option D is wrong because encryption must be enabled at launch, not after. Option E is wrong because KMS key must be specified at launch; can be changed later only for certain engines.

Answer

Modify the DB instance to enable encryption after creation.

Answer

Enable encryption at rest on the existing RDS instance via a modification.

Answer

Specify a KMS key after the instance is launched.

Question 12

A company is designing a data protection strategy for Amazon EFS file systems. The security team requires encryption at rest and in transit. Additionally, the team needs to control which KMS keys can be used to encrypt the file system. Which THREE steps should the team take?

Accepted Answer

Configure a KMS key policy that allows the EFS service to use the key.. You must configure the KMS key policy to allow the EFS service to use the key for encryption at rest. Option B is correct because encryption at rest is enabled by specifying a customer-managed KMS key when creating the EFS file system. Option E is correct because encryption in transit is enabled by using the TLS option when mounting the file system on the client. Option C is incorrect because EFS does not support SSE-S3; it uses KMS for encryption at rest. Option D is incorrect because IAM policies can restrict who can create encrypted file systems, but the question specifically asks about controlling which KMS keys can be used, which is done via KMS key policies, not IAM policies.

Answer

Enable default encryption on the EFS file system using SSE-S3.

Answer

Use an IAM policy to restrict which users can create encrypted file systems.

Question 13

A company wants to protect data stored in Amazon S3 Glacier. The data must be encrypted at rest and the encryption keys must be rotated annually. Which TWO options meet these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed key that has automatic key rotation enabled.. SSE-KMS with a customer-managed key that has automatic key rotation enabled allows annual rotation and meets the encryption requirement. Option E is correct because S3 Glacier's default encryption, SSE-S3, encrypts data at rest and AWS manages key rotation automatically on an annual basis. Option B is incorrect because AWS CloudHSM requires manual key rotation. Option C is incorrect because client-side encryption with the Amazon S3 encryption client does not use server-side encryption and requires manual key management. Option D is incorrect because SSE-C requires you to manage and rotate the keys manually.

Answer

Use AWS CloudHSM to generate a key and encrypt data before uploading to Glacier.

Answer

Use client-side encryption with the Amazon S3 encryption client.

Answer

Use SSE-C with keys stored in AWS Secrets Manager and rotate keys annually.

Question 14

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. The engineer attempts to upload a file using the AWS CLI without specifying any encryption. What is the outcome?

Accepted Answer

The upload succeeds because default encryption on the bucket will encrypt the object with SSE-S3.. The bucket policy includes a Deny effect with a condition 'StringNotEquals': {'s3:x-amz-server-side-encryption': 'aws:kms'}. This condition denies requests only when the x-amz-server-side-encryption header is present in the request and its value is not 'aws:kms'. If the header is absent (as when the user does not specify encryption), the condition evaluates to false, meaning the Deny rule does not apply. Therefore, the upload is not denied by this policy. Since new S3 buckets have default encryption enabled with SSE-S3, the object will be encrypted with SSE-S3, and the upload succeeds. Option A is incorrect because the policy does not deny all requests; it only denies those that include a supported but non-matching encryption header. Option C is incorrect because it assumes the Deny applies when the header is absent, which is not the case for 'StringNotEquals' (without 'IfExists'). Option D is similar to B but B is the more precise statement.

Answer

The upload fails because the policy denies all PutObject requests.

Answer

The upload fails because the policy denies PutObject when encryption is not SSE-KMS.

Answer

The upload succeeds because the object is encrypted with SSE-S3 by default.

Question 15

Refer to the exhibit. A user named John encrypts a file using the AWS CLI. John then tries to decrypt the file but receives an AccessDenied error. John has full administrator permissions in IAM. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant John the kms:Decrypt permission.. KMS key policies control access to the key independently of IAM policies. Even with full IAM admin permissions, John must be explicitly granted kms:Decrypt in the key policy. Option A is wrong because the error is AccessDenied, not MalformedCiphertextException. Option B is wrong because IAM policies do not deny the action; it is the key policy that does not allow it. Option D is wrong because a key mismatch would result in InvalidCiphertextException, not AccessDenied.

Answer

The ciphertext blob is malformed because it was not base64-decoded before decryption.

Answer

John's IAM policy denies the kms:Decrypt action.

Answer

The key ID used for encryption is different from the key used for decryption.