SCS-C02 Data Protection Practice Test 14 — 15 Questions

Question 1

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team needs to ensure high availability and durability of the keys. Which architecture should be recommended?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a CloudHSM cluster with at least two HSMs in different Availability Zones. Deploying a CloudHSM cluster with at least two HSMs in different Availability Zones provides high availability and durability. CloudHSM automatically synchronizes keys across HSMs in the cluster, so if one HSM fails, the others continue to provide access to the keys.

Answer

Use AWS KMS instead of CloudHSM for better durability

Answer

Deploy a single CloudHSM instance in one Availability Zone

Answer

Deploy CloudHSM in two AWS Regions with automatic replication

Question 2

A security engineer is investigating a potential data breach and finds this CloudTrail log entry. What does this entry indicate?

Accepted Answer

A user decrypted data using a KMS key. The CloudTrail entry shows a Decrypt API call against a KMS key, which indicates a principal used the key to decrypt ciphertext. This is the standard CloudTrail event emitted when KMS performs a cryptographic decryption operation.

Answer

A user encrypted data using a KMS key

Answer

An anonymous user accessed the KMS key

Answer

The KMS key was deleted

Question 3

A company uses S3 to store sensitive customer data. Which AWS service can automatically discover and classify this data to help meet compliance requirements?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It specifically identifies PII, PHI, credentials, and other sensitive content, generating findings that support compliance requirements such as GDPR, HIPAA, and PCI-DSS. This is the exact purpose for which Macie was designed.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch

Question 4

A security engineer is designing a data protection strategy for an S3 bucket that contains sensitive documents. The bucket is accessed by multiple IAM users and roles. Which TWO actions will help protect the data at rest and in transit?

Accepted Answer

Add a bucket policy that denies requests without aws:SecureTransport. Enforcing HTTPS (aws:SecureTransport) protects data in transit by requiring all requests to use TLS. Option D is correct because enabling default encryption (SSE-S3 or SSE-KMS) ensures data at rest is automatically encrypted when written to S3. Option A is incorrect: S3 Access Logs are for auditing access, not for protecting data. Option C is incorrect: MFA Delete protects against accidental deletion, not data protection at rest or in transit. Option E is incorrect: pre-signed URLs provide time-limited access but do not inherently protect data at rest or enforce encryption in transit.

Answer

Enable S3 Access Logs and send them to a separate account

Answer

Enable MFA Delete on the S3 bucket

Answer

Use pre-signed URLs for all access

Question 5

A company wants to protect data in transit between an EC2 instance and an S3 bucket. Which method should be used?

Accepted Answer

Use HTTPS endpoints for S3 API calls. To protect data in transit between an EC2 instance and an S3 bucket, you must use HTTPS endpoints for S3 API calls, which encrypts traffic using TLS. S3 supports HTTPS natively via its REST API endpoints, and this is the standard method to ensure encryption in transit for S3 access from EC2.

Answer

Use a VPN connection with IPsec

Answer

Install an SSL certificate on the EC2 instance

Answer

Use SSH to transfer files

Question 6

A security engineer needs to audit all access to a KMS customer managed key. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made to KMS, including Encrypt, Decrypt, GenerateDataKey, CreateKey, and key policy changes, capturing the caller identity, source IP, timestamp, and request parameters. This makes CloudTrail the authoritative service for auditing KMS key usage and access.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 7

A company wants to automate the detection of sensitive data in an S3 bucket. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to discover and classify sensitive data, making it the correct choice for automated detection of sensitive data in S3. AWS Artifact provides compliance reports, Amazon Inspector assesses vulnerabilities, and Amazon GuardDuty detects threats—none specifically focus on sensitive data detection.

Answer

AWS Artifact

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 8

A security engineer is tasked with ensuring that all data stored in an RDS DB instance is encrypted at rest. The database is already running and contains data. What should the engineer do?

Accepted Answer

Create a snapshot of the DB instance, copy it with encryption, and restore the encrypted snapshot. RDS encryption at rest can only be enabled at DB instance creation time; it cannot be turned on for an existing unencrypted instance. The supported migration path is to take a snapshot of the unencrypted instance, copy that snapshot with the encryption option enabled (specifying a KMS key), and then restore a new DB instance from the encrypted snapshot. This produces an encrypted instance containing the same data.

Answer

Change the KMS key associated with the DB instance

Answer

Modify the DB instance to use an encrypted storage type

Answer

Enable encryption at rest in the RDS console for the existing DB instance

Question 9

A company stores sensitive data in an S3 bucket with default encryption (SSE-S3) enabled. A security audit reveals that objects are being accessed by users from unexpected IP addresses. The company wants to enforce that only objects encrypted with a specific KMS key (managed by the security team) can be accessed. Which combination of actions should be taken?

Accepted Answer

Modify the bucket policy to deny PutObject and GetObject unless the request includes the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header.. It uses a bucket policy with the 's3:x-amz-server-side-encryption-aws-kms-key-id' condition key to deny requests that do not include the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header. This enforces that only objects encrypted with the specified KMS key can be accessed. Option A is incorrect because SSE-C uses customer-provided keys and does not integrate with KMS key IDs; distributing a customer key does not enforce the specific KMS key. Option C is incorrect because S3 Block Public Access and AWS WAF do not control access based on encryption key. Option D is incorrect because lifecycle policies do not restrict access based on encryption key.

Answer

Use SSE-C and distribute the customer key to authorized users only.

Answer

Enable S3 Block Public Access and use AWS WAF to filter IP addresses.

Answer

Apply an S3 Lifecycle policy to transition objects to Glacier after 30 days.

Question 10

A company is using Amazon S3 to store sensitive data. They want to ensure that all objects uploaded to a specific bucket are encrypted using server-side encryption with AWS KMS. Which bucket policy condition should be used to enforce this?

Accepted Answer

Condition: 's3:x-amz-server-side-encryption': 'aws:kms'. The bucket policy condition `s3:x-amz-server-side-encryption` with value `aws:kms` enforces that any PutObject request must include the `x-amz-server-side-encryption` header set to `aws:kms`. This ensures that objects are encrypted using SSE-KMS. The condition key is specific to the encryption algorithm, not the KMS key ID.

Answer

Condition: 's3:x-amz-server-side-encryption-customer-algorithm': 'AES256'

Answer

Condition: 's3:x-amz-server-side-encryption-aws-kms-key-id': 'arn:aws:kms:...'

Answer

Condition: 's3:x-amz-server-side-encryption': 'AES256'

Question 11

A company uses AWS KMS with a custom key store backed by AWS CloudHSM. The security team wants to ensure that the key material never leaves the HSM and that all cryptographic operations are performed within the HSM. Which of the following actions should the team take?

Accepted Answer

Create the KMS key in a custom key store and set the key usage to 'ENCRYPT_DECRYPT'.. To ensure key material never leaves the HSM and cryptographic operations are performed within the HSM, the team should create the KMS key in a custom key store (backed by CloudHSM) and set the key usage to ENCRYPT_DECRYPT. This ensures that the key material is stored and used only within the HSM. Option A is incorrect because asymmetric keys with SIGN_VERIFY usage are not the standard for encryption/decryption, and the key material could potentially be exported if the HSM allows. Option B is incorrect because the 'Prevent key material export' option is not available in KMS; custom key stores inherently prevent export. Option C is incorrect because the default key store uses software-based keys, not HSM hardware. Therefore, Option D is the correct answer.

Answer

Create the KMS key as an asymmetric key in a custom key store and set the key usage to 'SIGN_VERIFY'.

Answer

Enable the 'Prevent key material export' option in the KMS key policy.

Answer

Create the KMS key as a symmetric key in the default key store.

Question 12

A company is using Amazon S3 to store confidential documents. They want to ensure that all data is encrypted in transit between the S3 bucket and their on-premises application. Which of the following should be enforced?

Accepted Answer

Add a bucket policy that denies access unless 'aws:SecureTransport' is true.. A bucket policy that denies requests unless `aws:SecureTransport` is true enforces TLS for all access to the bucket, including from on-premises applications. This is the canonical AWS pattern for requiring encryption in transit to S3. The other options either do not enforce TLS or address different concerns (encryption at rest, network path).

Answer

Use Amazon CloudFront with a custom origin pointing to the S3 bucket.

Answer

Use a VPC endpoint for S3.

Answer

Enable default encryption (SSE-S3) on the bucket.

Question 13

A company is storing sensitive data in Amazon S3. They want to ensure that all data is encrypted at rest using server-side encryption. Which THREE options are available for server-side encryption in S3? (Select THREE.)

Accepted Answer

SSE-KMS. SSE-KMS (B) is a valid S3 server-side encryption option in which S3 encrypts objects using keys managed by AWS KMS, giving you control over key policies, audit trails via CloudTrail, and separation of permissions. SSE-S3 (C) is also correct: S3 manages the encryption keys entirely with AES-256, and it is the default server-side encryption applied to objects at rest. SSE-C (D) is correct as well: the customer provides the encryption key on each request, and S3 performs the encryption/decryption server-side without storing the key. Client-side encryption (A) is not server-side encryption because data is encrypted before it reaches S3, so S3 never performs the encryption. AWS CloudHSM (E) is a dedicated hardware security module service, not an S3 server-side encryption option, though it can be used with SSE-C or custom key management.

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 14

A security engineer is troubleshooting an issue where an Amazon RDS for MySQL DB instance encrypted at rest with AWS KMS is failing to launch. The error message indicates a KMS access issue. Which IAM role or policy is most likely missing?

Accepted Answer

The AWSServiceRoleForRDS service-linked role is missing. The AWSServiceRoleForRDS service-linked role is required for RDS to call AWS KMS on your behalf to manage encryption keys for encrypted DB instances. If this role is missing, RDS cannot obtain the necessary permissions to decrypt the KMS key during instance launch, resulting in a KMS access error. This role is automatically created the first time you create an RDS resource, but if it was deleted or not present, you must recreate it to resolve the issue.

Answer

The RDS subnet group is in a private subnet without a NAT gateway

Answer

The DB instance's security group does not allow outbound traffic to KMS

Answer

The KMS key policy does not grant access to the root account

Question 15

A company uses AWS CloudHSM to store encryption keys for a custom database encryption application. The application runs on Amazon EC2 instances and uses the PKCS#11 library to communicate with the HSM. Recently, the application started failing with 'CKR_SESSION_HANDLE_INVALID' errors. Which of the following is the most likely cause?

Accepted Answer

The application is not closing sessions properly, causing the HSM to reach the maximum number of open sessions. CKR_SESSION_HANDLE_INVALID is a PKCS#11 error indicating that the session handle used by the application is no longer valid. This typically occurs when the application opens sessions but fails to close them, eventually exhausting the HSM's maximum session limit. Once the limit is reached, new session requests fail or existing handles become invalid. Proper session management (closing sessions after use) is required to avoid this error.

Answer

The client certificate used for mutual TLS authentication has expired

Answer

The security group for the HSM does not allow inbound traffic from the EC2 instance

Answer

The HSM's firmware version is incompatible with the PKCS#11 library