SCS-C02 Data Protection Practice Test 15 — 15 Questions

Question 1

Which THREE of the following are valid key management features of AWS KMS? (Choose THREE.)

Accepted Answer

Importing key material. AWS KMS allows you to import your own key material (BYOK) for use with KMS keys, which is a valid key management feature. This is done via the 'ImportKeyMaterial' API, enabling you to create a KMS key with no key material and then upload your own symmetric key material. This feature is essential for meeting compliance requirements that mandate control over the key material lifecycle.

Answer

SSL certificate management

Answer

Password generation

Question 2

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which policy should be attached to the KMS key to enforce this restriction?

Accepted Answer

KMS key policy with a condition that the principal must be the specific IAM role. KMS key policies are the main mechanism to control access to KMS keys. By specifying the IAM role as the principal in a key policy statement for the kms:Decrypt action, only that role can decrypt using the key. Option A is incorrect because KMS grants are intended for temporary or cross-account access and are not the best practice for permanent control. Option B is incorrect because IAM policies alone are not sufficient if the key policy does not allow the role; both policies must align. Option C is incorrect because S3 bucket policies control access to S3 operations, not KMS decryption permissions directly.

Answer

KMS grant that gives the IAM role decrypt permissions for the key

Answer

IAM policy attached to the role that allows kms:Decrypt for the key

Answer

S3 bucket policy that denies decrypt unless the requester is the specific IAM role

Question 3

A company wants to protect data stored in Amazon S3 by encrypting it at rest using keys managed by the company. Which encryption option should be used?

Accepted Answer

SSE-C. (SSE-KMS) is incorrect because while the customer can manage KMS keys, they are stored and managed by AWS KMS, not directly provided by the customer. The question specifies the company manages the keys themselves. Option B (SSE-C) is correct because it allows the customer to provide their own encryption keys and manage them outside AWS. Option C (client-side encryption) is incorrect because it encrypts data before upload, not at rest in S3. Option D (SSE-S3) is incorrect because it uses AWS-managed keys, not customer-managed keys.

Answer

SSE-KMS

Answer

Client-side encryption

Answer

SSE-S3

Question 4

A security engineer is troubleshooting an issue where an Amazon RDS for MySQL DB instance is not encrypting data at rest. The DB instance was created without encryption. The engineer needs to enable encryption without significant downtime. What is the MOST effective approach?

Accepted Answer

Take a snapshot, copy it with encryption enabled, and restore a new DB instance from the encrypted snapshot. Take a snapshot, copy it with encryption enabled, and restore a new DB instance from the encrypted snapshot. This is the only way to enable encryption on an existing unencrypted RDS instance with minimal downtime, as it involves creating a new encrypted instance and redirecting traffic. Option A is incorrect because encrypting a snapshot directly is not possible; you must copy the snapshot with encryption. Option C is incorrect because existing RDS instances cannot be modified to add encryption. Option D is incorrect because read replicas cannot be promoted to enable encryption on the original instance; the read replica would also need to be encrypted from the start.

Answer

Take a snapshot of the DB instance and enable encryption on the snapshot

Answer

Modify the DB instance and enable encryption in the console

Answer

Create a read replica with encryption and promote it

Question 5

A company uses AWS CloudHSM to store encryption keys. The security team wants to ensure that keys stored in CloudHSM are backed up and can be restored in another AWS Region. What is the BEST approach?

Accepted Answer

Export the security domain from the source cluster and import it into a new cluster in the target region. AWS CloudHSM allows you to export the security domain from a source cluster, which contains the cryptographic material needed to back up and restore keys. You can then create a new CloudHSM cluster in the target region and import the security domain to restore the keys. Option A is incorrect because CloudHSM does not support automatic cross-region replication. Option B is incorrect because HSM user credentials alone do not contain the key material; they are used for authentication, not backup. Option C is incorrect because AWS Backup does not integrate with CloudHSM to back up the cluster's keys.

Answer

Enable automatic cross-region replication on the CloudHSM cluster

Answer

Copy the HSM user credentials and use them in the new region

Answer

Use AWS Backup to back up the CloudHSM cluster and restore in another region

Question 6

A company needs to ensure that data in transit between an on-premises data center and Amazon S3 is encrypted. The data will be transferred using HTTPS. What additional step should be taken to ensure the encryption is enforced?

Accepted Answer

Add a bucket policy that denies requests where aws:SecureTransport is false. Adding a bucket policy that denies requests where aws:SecureTransport is false ensures HTTPS is enforced for all data in transit to S3. Option A is wrong because AWS KMS manages encryption keys but does not enforce HTTPS. Option B is wrong because S3 Transfer Acceleration improves speed but does not enforce encryption. Option D is wrong because CloudFront can enforce HTTPS, but the question specifies the requirement is for direct S3 transfers, not through CloudFront.

Answer

Use AWS KMS to require encryption in transit

Answer

Enable S3 Transfer Acceleration

Answer

Use Amazon CloudFront with HTTPS only

Question 7

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects in the bucket are encrypted at rest. The bucket currently has default encryption configured with SSE-S3. A new requirement mandates that all objects must be encrypted with SSE-KMS using a specific customer-managed key. What is the MOST efficient way to enforce this without re-uploading existing objects?

Accepted Answer

Update the bucket default encryption to SSE-KMS and use S3 Batch Operations to re-encrypt existing objects. Updating the bucket default encryption to SSE-KMS only affects new objects, not existing ones. To enforce the new encryption requirement on existing objects without re-uploading, you can use S3 Batch Operations to copy objects in place with new encryption settings (e.g., using the --copy-source-s3-encryption-headers or a manifest to re-encrypt). Option A is inefficient for large datasets. Option B is incorrect because S3 Lifecycle policies do not re-encrypt objects; they only transition storage classes or expire objects. Option C is incorrect because changing default encryption does not automatically re-encrypt existing objects; you must use Batch Operations or a similar mechanism.

Answer

Use S3 Inventory to list objects and a script to copy each object to itself with new encryption

Answer

Use S3 Lifecycle policy to transition objects and re-encrypt them

Answer

Update the bucket default encryption to SSE-KMS and enable automatic re-encryption

Question 8

A company wants to protect sensitive data stored in an Amazon EBS volume. The volume is attached to an EC2 instance. Which action should be taken to ensure data at rest is encrypted?

Accepted Answer

Enable EBS encryption by default for the region and create a new encrypted volume. You can enable EBS encryption by default for the region, which automatically encrypts new volumes. Option A is wrong because you cannot encrypt an existing volume directly; you must create a snapshot and restore. Option B is wrong because instance store volumes are not persistent and encryption is not managed by EBS. Option C is wrong because encryption at the application layer is not a storage encryption method.

Answer

Enable encryption on the existing EBS volume

Answer

Use an instance store volume that supports encryption

Answer

Encrypt the data at the application layer before writing to the volume

Question 9

A company uses AWS Secrets Manager to store database credentials. The security team needs to ensure that secrets are automatically rotated every 30 days. The rotation function must be implemented with minimal operational overhead. Which approach should be used?

Accepted Answer

Enable automatic rotation in Secrets Manager and configure the rotation interval to 30 days. AWS Secrets Manager provides built-in automatic rotation for supported secrets, allowing you to configure the rotation interval directly in the secret's settings. This approach requires no custom infrastructure, minimizing operational overhead. Option A is incorrect because creating an EventBridge rule and a custom Lambda function adds unnecessary complexity when Secrets Manager can handle the scheduling automatically. Option B is incorrect because using a cron job with the AWS CLI is manual, error-prone, and not scalable for automated rotation. Option C is incorrect because it essentially duplicates Option A's approach (CloudWatch Events is the same as EventBridge) and is not the most streamlined method.

Answer

Create an Amazon EventBridge rule that triggers a Lambda function to rotate the secret

Answer

Use AWS CLI to schedule a cron job that runs every 30 days and rotates the secret

Answer

Use Amazon CloudWatch Events to invoke an AWS Lambda function that updates the secret

Question 10

Which TWO of the following are valid options for encrypting data at rest in Amazon S3? (Choose 2.)

Accepted Answer

SSE-S3. SSE-S3 is correct because it provides server-side encryption where Amazon S3 manages the encryption keys entirely. When you upload an object, S3 encrypts it using AES-256 before writing to disk and decrypts it when you access it, with no additional configuration needed beyond enabling the header `x-amz-server-side-encryption: AES256`.

Answer

SSL/TLS encryption

Answer

IAM policy encryption

Answer

CloudHSM client-side encryption

Question 11

Which THREE of the following are best practices for protecting data in transit within AWS? (Choose 3.)

Accepted Answer

Use TLS listeners on Elastic Load Balancers. Options B, D, and E are correct. Using TLS listeners on Elastic Load Balancers encrypts traffic between clients and the load balancer. Configuring Amazon CloudFront to require HTTPS ensures encrypted delivery to end users. AWS Site-to-Site VPN provides encrypted tunnels for hybrid connectivity. Option A is incorrect because VPC Peering does not natively encrypt traffic; the option 'with encryption' is not a built-in feature and can be misleading. Option C is incorrect because S3 Transfer Acceleration speeds up uploads over the public internet but does not guarantee encryption of data in transit; it uses HTTPS but the selection of this option does not inherently enforce encryption.

Answer

Use VPC Peering with encryption

Answer

Enable S3 Transfer Acceleration

Question 12

Which TWO of the following are valid methods to enforce encryption at rest for an Amazon RDS for PostgreSQL DB instance? (Choose 2.)

Accepted Answer

Restore a DB instance from an encrypted snapshot. Options B and E are correct. Encryption at rest for Amazon RDS can only be enabled when creating a new DB instance or by restoring from an encrypted snapshot. Option A is incorrect because you cannot enable encryption on an existing unencrypted instance. Option C is incorrect because you cannot enable encryption on a snapshot; you must create a copy with encryption. Option D is incorrect because read replicas inherit encryption settings from the source; an encrypted read replica requires an encrypted source, which would already require an encrypted instance.

Answer

Enable encryption on an existing unencrypted DB instance

Answer

Take a snapshot of the unencrypted instance and enable encryption on the snapshot

Answer

Create an encrypted read replica and promote it

Question 13

Refer to the exhibit. A user receives the above error when trying to decrypt a file using AWS KMS. The key policy is shown below:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AdminRole"
      },
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the likely cause of the error?

Accepted Answer

The IAM user 'john' is not granted kms:Decrypt in the key policy. The error occurs because the key policy only grants the kms:Decrypt action to the AdminRole (arn:aws:iam::123456789012:role/AdminRole). The IAM user 'john' is not a principal in the key policy and does not have the necessary permissions to decrypt the ciphertext. Option A is wrong because the ciphertext being encrypted with a different key would typically result in an 'InvalidCiphertextException', not a permission error. Option B is wrong because if the KMS key did not exist, the error would be 'NotFoundException'. Option C is wrong because an incorrect command syntax would produce a CLI parsing error, not a KMS permission error. Option D correctly identifies that the IAM user 'john' is not granted kms:Decrypt in the key policy.

Answer

The ciphertext was encrypted with a different KMS key

Answer

The KMS key does not exist

Answer

The command syntax is incorrect

Question 14

A company runs a critical application on Amazon EC2 instances that store sensitive data on EBS volumes. The security team has enabled EBS encryption by default for the region. However, after a recent security audit, it was discovered that some EBS volumes are not encrypted. The team finds that these volumes were created before the default encryption setting was enabled. The company's security policy mandates that all EBS volumes must be encrypted at rest, and the process must minimize downtime. The application cannot tolerate more than 5 minutes of downtime. The EC2 instances are running production workloads. What should the security engineer do to remediate the unencrypted volumes?

Accepted Answer

Create a new encrypted EBS volume, detach the unencrypted volume, and attach the new encrypted volume to the instance. Then copy data from a backup.. It allows creating a new encrypted volume and attaching it to the instance without significant downtime (a few minutes for detachment/attachment). Option A is wrong because enabling encryption on an existing volume is not supported. Option C is wrong because stopping the instance and creating an encrypted snapshot/volume would cause more downtime (stop/start). Option D is wrong because migrating to a new instance would require additional setup and likely more downtime.

Answer

Enable encryption on the existing EBS volumes directly from the console

Answer

Stop the instance, create an encrypted snapshot of the unencrypted volume, restore a new encrypted volume from the snapshot, and start the instance

Answer

Launch a new EC2 instance with an encrypted EBS volume, migrate the application to the new instance, and terminate the old instance

Question 15

A company stores sensitive customer data in Amazon S3. They want to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which S3 bucket policy statement should be added to deny uploads that do not request SSE-KMS?

Accepted Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'aws:kms'. The condition 's3:x-amz-server-side-encryption' with value 'aws:kms' enforces that objects are uploaded with SSE-KMS. Option A is incorrect because 'AES256' enforces SSE-S3, not SSE-KMS. Option C is incorrect because 'aws:SourceArn' is used for cross-account access, not encryption enforcement. Option D is incorrect because requiring the specific KMS key ID is too restrictive; the policy should only require the encryption type, not a particular key.

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'AES256'

Answer

Deny PutObject unless 'aws:SourceArn' equals the bucket ARN

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption-aws-kms-key-id' is present