SCS-C02 Data Protection Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. A developer attempts to upload an object with the header x-amz-server-side-encryption: AES256. What will happen?

Accepted Answer

The upload fails with an AccessDenied error.. The policy denies PutObject if the encryption header is not equal to 'aws:kms'. Since the developer uses AES256, the condition StringNotEquals evaluates to true, so the Deny applies. Upload fails. Option B is correct. Option A is wrong because AES256 is not allowed. Option C is wrong because the request is denied. Option D is wrong because there is no policy that allows only SSE-KMS; the Deny applies.

Answer

The upload succeeds because the policy only denies unencrypted uploads.

Answer

The upload succeeds because the policy allows all encryption methods.

Answer

The upload succeeds because the object is encrypted with AES256.

Question 2

Refer to the exhibit. A security engineer runs the AWS CLI command shown and receives an AccessDenied error. The IAM user Alice has a policy that grants kms:Decrypt on all resources. What is the most likely cause of the error?

Accepted Answer

The KMS key policy does not grant kms:Decrypt to the IAM user Alice.. The KMS key policy likely restricts access to specific principals. Even if IAM allows, the key policy can deny. Option C is correct. The command syntax (Option A) is correct. The key ID (Option B) is valid. IAM policy (Option D) is not the issue since it grants Decrypt.

Answer

The IAM user policy does not allow kms:Decrypt.

Answer

The command uses the wrong key ID.

Answer

The ciphertext blob is corrupted.

Question 3

Refer to the exhibit. A security engineer runs the command shown and gets the output. What does this output indicate about the bucket's encryption configuration?

Accepted Answer

The bucket has default encryption enabled using SSE-S3.. The output shows default encryption is set to SSE-S3 (AES256). This means new objects will be encrypted with SSE-S3 unless a different encryption header is provided. Option A is correct. Option B is wrong because it's SSE-S3, not SSE-KMS. Option C is wrong because default encryption does not prevent client-side encryption. Option D is wrong because the bucket does not enforce SSE-KMS.

Answer

The bucket does not allow unencrypted objects.

Answer

The bucket has default encryption enabled using SSE-KMS.

Answer

The bucket requires all objects to be encrypted with SSE-KMS.

Question 4

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type meets this requirement?

Accepted Answer

AWS managed key (aws/s3). AWS managed keys (aws/s3) are automatically rotated every year. Customer managed keys (CMKs) can be rotated manually or automatically, but the question specifies automatic rotation. Option B is correct because AWS managed keys are automatically rotated. Option A is incorrect because customer managed keys require manual rotation or enabling automatic rotation. Option C is incorrect because imported key material does not support automatic rotation. Option D is incorrect because asymmetric keys are not automatically rotated.

Answer

Customer managed key with manual rotation

Answer

Asymmetric customer managed key

Answer

Imported key material in a customer managed key

Question 5

A financial services company is designing a data protection strategy for its DynamoDB table containing sensitive customer data. The table has a global secondary index (GSI). The company needs to encrypt the data at rest using a customer managed key (CMK) that is rotated annually. Which solution meets these requirements?

Accepted Answer

Create the table with a customer managed key (CMK) and enable automatic key rotation. DynamoDB supports encryption at rest using AWS KMS. When a table is created, you can specify a CMK. The GSI inherits the encryption settings from the base table. Option D is correct because you can specify a CMK at table creation and enable automatic key rotation. Option A is incorrect because you cannot change the encryption key after table creation without recreating the table. Option B is incorrect because using an AWS managed key does not allow customer-controlled rotation. Option C is incorrect because enabling encryption on the GSI separately is not supported; encryption is inherited from the table.

Answer

Create the table with default encryption, then update the table to use a CMK and enable automatic rotation

Answer

Create the table without encryption, then enable encryption on the table and GSI separately using a CMK

Answer

Create the table with an AWS managed key and use AWS KMS automatic rotation

Question 6

A company uses Amazon S3 to store confidential documents. The security team wants to ensure that all objects are encrypted at rest using server-side encryption with AES-256. Which S3 encryption option should be used?

Accepted Answer

SSE-S3. Server-Side Encryption with S3-Managed Keys (SSE-S3) uses AES-256. Option A is correct. SSE-C uses customer-provided keys, SSE-KMS uses KMS keys, and client-side encryption is done by the customer.

Answer

SSE-C

Answer

SSE-KMS

Answer

Client-side encryption

Question 7

A company uses AWS KMS to encrypt its RDS database. The security team needs to ensure that the key can be used only from within the company's VPC and not from the internet. Which action should be taken?

Accepted Answer

Create a VPC endpoint for KMS and modify the key policy to allow only requests from the VPC endpoint. KMS supports VPC endpoints (AWS PrivateLink) and key policies with conditions. To restrict usage to a VPC, you can create a VPC endpoint for KMS and modify the key policy to deny access unless the request comes from the VPC endpoint. Option D is correct. Option A is incorrect because KMS keys are regional, not restricted to VPCs via that attribute. Option B is incorrect as it would deny all access. Option C is incorrect because the VPC endpoint is needed, and the key policy must reference it.

Answer

Enable automatic key rotation and use an alias to restrict access

Answer

Use a key policy that denies all access except from the RDS instance's security group

Answer

Create the key with a region restriction in the key policy

Question 8

A company is using Amazon S3 to store backup files that must be retained for 7 years. The files are accessed infrequently but must be available within minutes when needed. The company wants to minimize storage costs while ensuring data is encrypted at rest. Which storage class and encryption combination is most cost-effective?

Accepted Answer

S3 Glacier Instant Retrieval with SSE-S3. S3 Glacier Deep Archive is the lowest-cost storage class for long-term retention but has retrieval times of 12 hours, which does not meet the 'minutes' requirement. S3 Glacier Instant Retrieval provides milliseconds retrieval and is cost-effective for infrequent access. Option B is correct. SSE-S3 provides encryption at no additional cost. Options A and C have longer retrieval times. Option D is more expensive.

Answer

S3 Glacier Deep Archive with SSE-S3

Answer

S3 Glacier Flexible Retrieval with SSE-KMS

Answer

S3 Standard-IA with SSE-KMS

Question 9

A company needs to encrypt data at rest in its Amazon EBS volumes. The company wants to use an encryption key that is automatically rotated every year without any manual intervention. Which key type should be used?

Accepted Answer

AWS managed key for EBS. AWS managed keys are automatically rotated annually. Customer managed keys can have automatic rotation enabled, but the question implies a managed solution. Option B is correct. Option A is incorrect because customer managed keys require enabling automatic rotation. Option C is incorrect because imported keys do not support automatic rotation. Option D is incorrect because the default EBS encryption uses an AWS managed key, but the question asks for the key type.

Answer

Imported key material in a customer managed key

Answer

Customer managed key with manual rotation

Answer

Default EBS encryption using an AWS managed key

Question 10

A company uses AWS KMS to encrypt data in Amazon S3. The security team needs to audit all KMS key usage, including who used the key, when, and what operation was performed. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all AWS KMS API calls as events, including who made the request, the source IP address, the time of the request, and the specific operation performed (e.g., Encrypt, Decrypt, GenerateDataKey). These audit logs are stored in an S3 bucket and can be analyzed to meet the security team's requirement for full key usage auditing.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudHSM

Question 11

A company is designing a data protection strategy for its Amazon RDS for MySQL database. The database contains sensitive data that must be encrypted at rest. The company also needs to manage the encryption keys using its own HSM. Which solution should be used?

Accepted Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM. RDS supports encryption at rest using KMS. To use a customer-managed HSM, you can use AWS CloudHSM with a custom key store in KMS. Option C is correct. Option A is incorrect because RDS does not directly integrate with CloudHSM. Option B is incorrect because the default key is AWS managed. Option D is incorrect because RDS does not support client-side encryption for at-rest data.

Answer

Use client-side encryption with a key from CloudHSM

Answer

Use AWS CloudHSM to generate a key and import it into RDS

Answer

Enable encryption at rest using the default AWS KMS key

Question 12

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted in transit between the company's on-premises data center and AWS. Which solution should be used?

Accepted Answer

Use an AWS Site-to-Site VPN with IPsec to encrypt traffic. An AWS Site-to-Site VPN with IPsec is the correct solution because it creates an encrypted tunnel between the on-premises data center and AWS, ensuring all data in transit is protected. IPsec operates at the network layer (Layer 3) and encrypts the entire IP packet, providing confidentiality and integrity for data moving over the public internet. This directly addresses the requirement to encrypt data in transit between the two environments.

Answer

Use AWS CloudHSM to encrypt the data in transit

Answer

Enable SSE-S3 on the S3 bucket

Answer

Use AWS KMS to encrypt the data before transmission

Question 13

A company is designing a data protection strategy for its Amazon S3 bucket that stores sensitive customer data. The bucket must be encrypted at rest using a customer managed key (CMK) that is stored in AWS KMS. The company also needs to ensure that only authorized users can decrypt objects. Which TWO actions should the company take?

Accepted Answer

Modify the KMS key policy to allow only the authorized IAM roles to use the key. To control decryption access, you need to grant kms:Decrypt permission to authorized users and restrict the key policy accordingly. Option B and D are correct because they control access to the key. Option A is incorrect because a bucket policy alone cannot control decryption; it works with the key policy. Option C is incorrect because SSE-KMS uses KMS keys, not SSE-C. Option E is incorrect because S3 does not support IAM conditions for VPC endpoint on decryption.

Answer

Create a bucket policy that denies s3:GetObject unless the request includes a specific encryption context

Answer

Create a VPC endpoint for S3 and use bucket policies to restrict access to the endpoint

Answer

Use SSE-C with a customer-provided key

Question 14

A company uses AWS KMS to encrypt data in Amazon RDS. The security team wants to ensure that the KMS key can be used only by specific IAM roles and that all usage of the key is logged. Which TWO actions should the team take?

Accepted Answer

Enable AWS CloudTrail to log KMS API calls. To restrict key usage, use a key policy that allows only specific IAM roles. To log usage, enable CloudTrail logging. Option A and D are correct. Option B is incorrect because enabling key rotation does not control access. Option C is incorrect because cross-account access is not needed. Option E is incorrect because S3 bucket policies do not control KMS key usage.

Answer

Apply an S3 bucket policy to the RDS automated backup bucket

Answer

Enable automatic key rotation

Answer

Create a cross-account key policy to allow all IAM roles in the account

Question 15

A company is implementing a data protection strategy for its Amazon S3 bucket that contains sensitive data. The company requires that all objects be encrypted at rest using server-side encryption with a customer managed key (SSE-KMS). Additionally, the company wants to ensure that only a specific IAM role can decrypt objects. Which THREE actions should the company take?

Accepted Answer

Attach an IAM policy to the specific role that grants kms:Decrypt on the customer managed key. To enforce SSE-KMS, use a bucket policy that denies PutObject without the x-amz-server-side-encryption header set to aws:kms and a specific key. To control decryption, grant kms:Decrypt to the specific role. Option A, C, and D are correct. Option B is incorrect because using SSE-S3 does not meet the requirement. Option E is incorrect because client-side encryption is not S3 server-side encryption.

Answer

Use the default S3-managed key (SSE-S3) for encryption

Answer

Use client-side encryption with a customer managed key

SCS-C02 Data Protection Practice Test 14 — 15 Questions

Exhibit

SCS-C02 Data Protection Practice Test 14 — 15 Questions

Exhibit