SCS-C02 Data Protection Practice Test 14 — 15 Questions

Question 1

A company is migrating sensitive data to Amazon S3. The data must be encrypted at rest using keys managed by the company. The company also requires an audit trail of key usage. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use SSE-KMS with a customer-managed key and enable CloudTrail for KMS.. SSE-KMS with a customer-managed key and CloudTrail for KMS. This solution meets both requirements: the company manages its own keys (customer-managed CMK) and CloudTrail logs every KMS API call, providing an audit trail of key usage. Option A (SSE-S3) uses Amazon-managed keys, so no customer control or audit trail. Option B (SSE-C) requires the customer to manage keys themselves but does not integrate with CloudTrail for key usage auditing; also, storing keys in Secrets Manager does not provide an audit trail of KMS key usage. Option D (CloudHSM) can be used, but it requires more complex setup for auditing; SSE-KMS with CloudTrail is the simpler and more direct solution.

Answer

Use SSE-S3 with default encryption.

Answer

Use SSE-C and store the keys in AWS Secrets Manager.

Answer

Use AWS CloudHSM to generate and store keys, and use Amazon S3 with SSE-KMS.

Question 2

A company's security policy requires that all data stored in Amazon S3 be encrypted using envelope encryption with a key hierarchy. The master key must be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated. Which solution should the company implement?

Accepted Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.. AWS KMS with a custom key store backed by AWS CloudHSM provides envelope encryption with a key hierarchy, and CloudHSM is FIPS 140-2 Level 3 validated. Option B is wrong because the default KMS key store uses FIPS 140-2 Level 2 validated HSMs, not Level 3. Option C is wrong because SSE-S3 uses server-side encryption with S3-managed keys and does not provide envelope encryption or a key hierarchy. Option D is wrong because while CloudHSM provides the HSM, you would need to implement envelope encryption yourself, and the requirement specifies using a key hierarchy, which KMS provides natively.

Answer

Use AWS KMS with the default KMS key store.

Answer

Use Amazon S3 with SSE-S3 and enable default encryption.

Answer

Use AWS CloudHSM to generate a master key and implement envelope encryption in the application.

Question 3

A company needs to encrypt data at rest for an Amazon RDS for Oracle database. The database is deployed in a Multi-AZ configuration. The company also wants to encrypt automated backups and snapshots. Which TWO steps should the security team take?

Accepted Answer

Enable encryption at rest when launching the RDS instance.. Encryption must be enabled at launch; it cannot be added later. Option C is correct because enabling encryption at rest automatically encrypts backups and snapshots. Option B is wrong because encryption cannot be enabled on an existing unencrypted instance. Option D is wrong because encryption must be enabled at launch, not after. Option E is wrong because KMS key must be specified at launch; can be changed later only for certain engines.

Answer

Modify the DB instance to enable encryption after creation.

Answer

Enable encryption at rest on the existing RDS instance via a modification.

Answer

Specify a KMS key after the instance is launched.

Question 4

A company is designing a data protection strategy for Amazon EFS file systems. The security team requires encryption at rest and in transit. Additionally, the team needs to control which KMS keys can be used to encrypt the file system. Which THREE steps should the team take?

Accepted Answer

Configure a KMS key policy that allows the EFS service to use the key.. You must configure the KMS key policy to allow the EFS service to use the key for encryption at rest. Option B is correct because encryption at rest is enabled by specifying a customer-managed KMS key when creating the EFS file system. Option E is correct because encryption in transit is enabled by using the TLS option when mounting the file system on the client. Option C is incorrect because EFS does not support SSE-S3; it uses KMS for encryption at rest. Option D is incorrect because IAM policies can restrict who can create encrypted file systems, but the question specifically asks about controlling which KMS keys can be used, which is done via KMS key policies, not IAM policies.

Answer

Enable default encryption on the EFS file system using SSE-S3.

Answer

Use an IAM policy to restrict which users can create encrypted file systems.

Question 5

A company wants to protect data stored in Amazon S3 Glacier. The data must be encrypted at rest and the encryption keys must be rotated annually. Which TWO options meet these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed key that has automatic key rotation enabled.. SSE-KMS with a customer-managed key that has automatic key rotation enabled allows annual rotation and meets the encryption requirement. Option E is correct because S3 Glacier's default encryption, SSE-S3, encrypts data at rest and AWS manages key rotation automatically on an annual basis. Option B is incorrect because AWS CloudHSM requires manual key rotation. Option C is incorrect because client-side encryption with the Amazon S3 encryption client does not use server-side encryption and requires manual key management. Option D is incorrect because SSE-C requires you to manage and rotate the keys manually.

Answer

Use AWS CloudHSM to generate a key and encrypt data before uploading to Glacier.

Answer

Use client-side encryption with the Amazon S3 encryption client.

Answer

Use SSE-C with keys stored in AWS Secrets Manager and rotate keys annually.

Question 6

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. The engineer attempts to upload a file using the AWS CLI without specifying any encryption. What is the outcome?

Accepted Answer

The upload succeeds because default encryption on the bucket will encrypt the object with SSE-S3.. The bucket policy includes a Deny effect with a condition 'StringNotEquals': {'s3:x-amz-server-side-encryption': 'aws:kms'}. This condition denies requests only when the x-amz-server-side-encryption header is present in the request and its value is not 'aws:kms'. If the header is absent (as when the user does not specify encryption), the condition evaluates to false, meaning the Deny rule does not apply. Therefore, the upload is not denied by this policy. Since new S3 buckets have default encryption enabled with SSE-S3, the object will be encrypted with SSE-S3, and the upload succeeds. Option A is incorrect because the policy does not deny all requests; it only denies those that include a supported but non-matching encryption header. Option C is incorrect because it assumes the Deny applies when the header is absent, which is not the case for 'StringNotEquals' (without 'IfExists'). Option D is similar to B but B is the more precise statement.

Answer

The upload fails because the policy denies all PutObject requests.

Answer

The upload fails because the policy denies PutObject when encryption is not SSE-KMS.

Answer

The upload succeeds because the object is encrypted with SSE-S3 by default.

Question 7

Refer to the exhibit. A user named John encrypts a file using the AWS CLI. John then tries to decrypt the file but receives an AccessDenied error. John has full administrator permissions in IAM. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant John the kms:Decrypt permission.. KMS key policies control access to the key independently of IAM policies. Even with full IAM admin permissions, John must be explicitly granted kms:Decrypt in the key policy. Option A is wrong because the error is AccessDenied, not MalformedCiphertextException. Option B is wrong because IAM policies do not deny the action; it is the key policy that does not allow it. Option D is wrong because a key mismatch would result in InvalidCiphertextException, not AccessDenied.

Answer

The ciphertext blob is malformed because it was not base64-decoded before decryption.

Answer

John's IAM policy denies the kms:Decrypt action.

Answer

The key ID used for encryption is different from the key used for decryption.

Question 8

Refer to the exhibit. A security engineer reviews the bucket policy for an S3 bucket. The engineer attempts to upload an object to the bucket using the AWS CLI without the --ssl flag (HTTP). What is the outcome?

Accepted Answer

The upload fails because the policy denies requests that are not using HTTPS.. The bucket policy includes a condition that explicitly denies all s3: actions (including s3:PutObject) when the request does not use HTTPS (SecureTransport is false). Since the engineer uses HTTP (no --ssl flag), the condition is met, and the upload is denied. Option A is incorrect because the policy does not allow all actions; it includes a conditional deny. Option C is incorrect because default encryption does not override the explicit deny in the policy. Option D is incorrect because the policy denies all s3 actions, not just s3:PutObject.

Answer

The upload succeeds because the policy allows all actions.

Answer

The upload succeeds because the bucket has default encryption enabled.

Answer

The upload fails because the policy denies s3:PutObject only.

Question 9

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They must manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys and manage rotation. SSE-S3 uses AWS-managed keys (no customer control). SSE-KMS uses KMS keys but AWS manages rotation unless using customer-managed keys with automatic rotation. Option C is correct because SSE-C gives full control over key management and rotation.

Answer

SSE-S3

Answer

SSE-KMS with AWS managed key

Answer

Client-side encryption

Question 10

A security engineer needs to ensure that all data in transit between an Application Load Balancer and EC2 instances is encrypted using TLS. Which configuration is required?

Accepted Answer

Configure the ALB with an HTTPS listener and the target group with HTTPS protocol.. To encrypt data in transit between the Application Load Balancer and EC2 instances, the ALB must have an HTTPS listener and the target group must use HTTPS protocol. This ensures end-to-end TLS encryption from client to ALB and from ALB to EC2 instances. Option A correctly specifies this configuration.

Answer

Configure the ALB with an HTTPS listener and the target group with HTTP protocol.

Answer

Configure the ALB with a TLS listener and the target group with TCP protocol.

Answer

Configure the ALB with a TCP listener and the target group with HTTP protocol.

Question 11

A company stores sensitive data in Amazon S3 and requires that objects are automatically encrypted using server-side encryption with AWS KMS. The bucket policy must deny any PUT request that does not include the x-amz-server-side-encryption header with value aws:kms. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The condition key s3:x-amz-server-side-encryption can be used to check the header value. Condition key aws:SourceIp is for source IP; aws:RequestedRegion is for region; kms:EncryptionContext is for KMS encryption context. Option A is correct.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

kms:EncryptionContext

Question 12

A company wants to protect data in transit between an on-premises data center and AWS over the internet. Which AWS service should they use to create a dedicated, encrypted connection?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN provides an encrypted tunnel over the internet between on-premises and AWS. AWS Direct Connect provides a dedicated connection but is not encrypted by default; IPsec can be added. AWS Transit Gateway is a network transit hub, not a connection type. AWS Client VPN is for individual clients. Option C is correct.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Answer

AWS Client VPN

Question 13

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

Accepted Answer

The bucket policy does not include the aws:SourceVpce condition.. The AccessDenied error occurs because the S3 bucket policy must include the aws:SourceVpce condition to allow access from the specific VPC endpoint. Without this condition, the bucket policy denies all requests that do not originate from the endpoint, regardless of IAM permissions. Option B is correct because the missing condition is the most likely cause.

Answer

The IAM role does not have sufficient permissions.

Answer

The VPC endpoint policy is blocking the request.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Question 14

A company uses AWS KMS to encrypt data in Amazon RDS. The security team needs to ensure that the KMS key cannot be deleted accidentally. Which action should be taken?

Accepted Answer

Add a statement to the key policy that denies the kms:ScheduleKeyDeletion action.. To prevent accidental deletion of an AWS KMS key, you can add a statement to the key policy that denies the `kms:ScheduleKeyDeletion` action. This ensures that even authorized users cannot schedule the key for deletion. Option C is correct because it directly addresses the requirement by denying the action that initiates deletion. Options A and B do not prevent deletion; creating an alias or enabling automatic key rotation have no effect on deletion prevention. Option D, using a multi-Region key, does not prevent deletion of the primary key. Therefore, the correct answer is C.

Answer

Create an alias for the key.

Answer

Enable automatic key rotation.

Answer

Use a multi-Region key.

Question 15

A company has an S3 bucket with versioning enabled. They want to ensure that all deleted objects are retained for 90 days before permanent deletion. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policy with NoncurrentVersionExpiration. S3 Lifecycle policies can manage the expiration of noncurrent versions of objects. In this scenario, after an object is deleted, it becomes a noncurrent version. A lifecycle rule with NoncurrentVersionExpiration can be set to permanently delete those noncurrent versions after a specified number of days (e.g., 90). Option A is correct. S3 Object Lock protects objects from deletion but does not automatically delete them after a period. S3 Replication is for copying objects to another bucket. MFA Delete adds a multi-factor authentication requirement for deletion but does not set a retention period.

Answer

S3 Replication

Answer

S3 Object Lock

Answer

MFA Delete