SCS-C02 Data Protection Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. A security engineer is reviewing the key policy for a customer managed key. The engineer notices that a user with the IAM role 'Admin' can encrypt and decrypt data using this key. However, the engineer wants to ensure that only requests coming from the company's VPC (vpc-12345678) can use the key. What should be added to the key policy?

Accepted Answer

Add a condition aws:SourceVpc with value vpc-12345678 to the 'Allow use of the key' statement. To restrict key usage to a VPC, you need to add a condition to the key policy using the aws:SourceVpc key. Option B is correct. Option A is incorrect because the condition should be added to the existing statements, not a new statement. Option C is incorrect because kms:ViaService restricts to a service endpoint, not a VPC. Option D is incorrect because kms:CallerAccount is not relevant.

Answer

Add a condition kms:ViaService with value s3.amazonaws.com

Answer

Add a condition kms:CallerAccount with value 111122223333

Answer

Add a new statement with Effect: Deny and a condition aws:SourceVpc not equal to vpc-12345678

Question 2

Refer to the exhibit. A security engineer is reviewing the bucket encryption configuration. The bucket is used to store sensitive data. The company policy requires that all objects be encrypted using AWS KMS with a customer managed key. What should the engineer do to meet the policy?

Accepted Answer

Update the bucket encryption configuration to use SSEAlgorithm: aws:kms and specify a KMS key ID. The current configuration uses SSE-S3 (AES256). To use SSE-KMS, the engineer should modify the bucket encryption configuration to use aws:kms and specify a key ID. Option A is correct. Option B is incorrect because specifying a KMS key in the bucket policy does not enforce encryption. Option C is incorrect because enabling default encryption with SSE-S3 does not change the algorithm. Option D is incorrect because client-side encryption is not server-side.

Answer

Enable the bucket key and set SSEAlgorithm to AES256

Answer

Use client-side encryption with a KMS key

Answer

Add a bucket policy that requires kms:Encrypt permission for all PutObject requests

Question 3

Refer to the exhibit. A security engineer is reviewing the CloudWatch Logs configuration for a Lambda function. The log group is encrypted with a customer managed key. The engineer needs to ensure that only the Lambda service can write logs to this log group and that only a specific IAM role can read logs. Which additional configuration is required?

Accepted Answer

Add a condition to the KMS key policy that uses kms:ViaService to restrict encryption/decryption to logs.amazonaws.com and a condition that the Lambda function is the source. CloudWatch Logs uses a service-linked role to write logs. To restrict writing to the Lambda service, you need to add a condition to the key policy that allows the logs service only when the request comes from Lambda. Option C is correct. Option A is incorrect because a bucket policy is for S3. Option B is incorrect because resource-based policies on log groups are for cross-account access, not to restrict write access. Option D is incorrect because IAM roles cannot be assigned to log groups.

Answer

Attach a resource-based policy to the log group that allows only the Lambda service to write logs

Answer

Create an S3 bucket policy to allow only Lambda to write to the log group

Answer

Assign an IAM role to the log group that has permission to write logs

Question 4

A company stores sensitive customer data in Amazon S3. To comply with data protection regulations, they need to automatically prevent any new objects from being made publicly accessible. Which S3 feature should they configure?

Accepted Answer

Enable S3 Block Public Access at the account level.. Option B is correct because S3 Block Public Access settings at the account or bucket level can enforce that no new objects or ACLs grant public access. Option A is wrong because bucket policies can be circumvented if not enforced; Block Public Access is a preventative guardrail. Option C is wrong because Object Lock prevents deletion/overwrite but doesn't control public access. Option D is wrong because default encryption only encrypts data at rest.

Answer

Configure a bucket policy that denies s3:PutObject with a condition for public access.

Answer

Use S3 default encryption with SSE-S3.

Answer

Enable S3 Object Lock in governance mode.

Question 5

A company uses AWS KMS to encrypt data in Amazon S3. Security team wants to ensure that only specific IAM roles can decrypt objects. Which KMS key policy configuration should be used?

Accepted Answer

In the key policy, use a Condition block with kms:ViaService set to s3.<region>.amazonaws.com and allow kms:Decrypt for the role.. Option C is correct because using kms:ViaService condition restricts key usage to requests coming from S3, and the IAM role's permissions to decrypt are granted via the key policy, not just IAM policy. Option A is wrong because without the key policy granting decrypt, the IAM policy alone is insufficient. Option B is wrong because it grants blanket access to the role without the S3 service restriction. Option D is wrong because it doesn't restrict to a specific role.

Answer

Attach an IAM policy to the role that allows kms:Decrypt, and leave the KMS key policy with default settings.

Answer

In the key policy, use a Principal element specifying the role ARN, and allow kms:Decrypt.

Answer

Use a grant for the role to allow kms:Decrypt for S3 operations.

Question 6

A company needs to protect data at rest on Amazon EBS volumes attached to EC2 instances. Which solution provides the most control over the encryption keys?

Accepted Answer

Use a customer managed KMS key with EBS encryption.. Option A is correct because using a customer managed KMS key allows the customer to control key rotation, policies, and access. Option B is wrong because AWS managed keys do not allow customer control. Option C is wrong because EBS encryption by default uses AWS managed keys unless specified. Option D is wrong because client-side encryption would require application changes.

Answer

Encrypt data using client-side encryption before writing to EBS.

Answer

Use an AWS managed KMS key for EBS encryption.

Answer

Enable EBS encryption by default in the account.

Question 7

A company uses Amazon RDS for MySQL with encryption at rest enabled using AWS KMS. They need to ensure that automated backups and snapshots are also encrypted. Which configuration is required?

Accepted Answer

No additional configuration is needed; backups are encrypted automatically.. Option C is correct because RDS automatically encrypts snapshots and backups when the source database is encrypted. No additional steps are needed. Option A is wrong because encryption is already inherited. Option B is wrong because the same KMS key is used by default. Option D is wrong because enabling encryption on a non-encrypted instance requires a snapshot copy with encryption.

Answer

Manually encrypt each snapshot with a separate KMS key.

Answer

Create a new KMS key and assign it to the backup configuration.

Answer

Enable encryption on the RDS instance after creation.

Question 8

A company uses AWS Secrets Manager to rotate database credentials automatically. The security team wants to ensure that while the secret is being rotated, applications can always retrieve a valid credential. Which rotation strategy should be used?

Accepted Answer

Use the alternating users rotation strategy.. Option B is correct because the alternating users strategy creates two sets of credentials, so during rotation, one set remains valid. Option A is wrong because it may cause downtime if the single credential is updated. Option C is wrong because disabling rotation defeats the purpose. Option D is wrong because IAM database authentication doesn't use secrets managed by Secrets Manager.

Answer

Use AWS IAM database authentication instead.

Answer

Use a single user rotation with immediate update.

Answer

Disable automatic rotation and manually update credentials.

Question 9

A company needs to share an encrypted Amazon S3 object with another AWS account. The object is encrypted with an AWS KMS customer managed key. Which steps are required?

Accepted Answer

Update both the bucket policy and the KMS key policy to grant cross-account access.. Option D is correct because both bucket policy and key policy need to grant cross-account access. Option A is wrong because only bucket policy is not enough; the key policy must also allow. Option B is wrong because key policy alone is insufficient; the bucket policy must allow s3:GetObject. Option C is wrong because object ACLs cannot grant cross-account access when KMS encryption is used.

Answer

Use an object ACL to grant the other account read access.

Answer

Update the bucket policy to allow the other account to access the object.

Answer

Update the KMS key policy to allow the other account to decrypt.

Question 10

A company is designing a data protection solution for Amazon S3 that must prevent any user from accidentally deleting objects. Which combination of S3 features should be used?

Accepted Answer

Enable S3 Versioning and MFA Delete.. Option A is correct because MFA Delete adds an extra factor for deletions, and versioning allows recovery of deleted objects. Option B is wrong because Object Lock prevents overwrites/deletion only if retention period is set, but doesn't prevent deletion of the bucket. Option C is wrong because replication doesn't protect against deletion. Option D is wrong because default encryption doesn't prevent deletion.

Answer

Use S3 Cross-Region Replication to another bucket.

Answer

Enable S3 Object Lock with governance mode.

Answer

Configure S3 default encryption with SSE-KMS.

Question 11

A company stores sensitive data in Amazon DynamoDB and uses AWS KMS with a customer managed key for encryption. The security team wants to ensure that only specific applications can access the table data. Which policy configuration should be used?

Accepted Answer

In the KMS key policy, allow the role to decrypt with a condition kms:ViaService = dynamodb.<region>.amazonaws.com.. Option C is correct because using kms:ViaService restricts key usage to DynamoDB, and the key policy grants decrypt to the role. Option A is wrong because IAM policy alone is insufficient; the key policy must allow. Option B is wrong because it doesn't restrict to DynamoDB. Option D is wrong because grants are not typically used for service-level restrictions.

Answer

In the KMS key policy, allow the application role to perform kms:Decrypt.

Answer

Use a KMS grant to allow the application to use the key.

Answer

Attach an IAM policy to the application role allowing dynamodb:GetItem and kms:Decrypt.

Question 12

A company wants to protect data in transit between an on-premises application and Amazon S3. Which solution provides the highest security?

Accepted Answer

Use an AWS PrivateLink endpoint for S3.. Option A is correct because AWS PrivateLink connects via private IPs within the AWS network, avoiding the public internet. Option B is wrong because VPN encrypts but still traverses the internet or VPN connection. Option C is wrong because HTTPS over internet uses encryption but is exposed to internet threats. Option D is wrong because Direct Connect provides a private connection but without encryption; additional encryption is needed.

Answer

Use a site-to-site VPN connection to the VPC and then access S3 via a VPC endpoint.

Answer

Use AWS Direct Connect without additional encryption.

Answer

Access S3 over HTTPS from the on-premises application.

Question 13

A company is using AWS KMS to encrypt data in Amazon S3. They need to ensure that the KMS key can only be used from within a specific VPC. Which TWO actions should be taken?

Accepted Answer

Create a VPC endpoint for AWS KMS.. Option A is correct because a VPC endpoint for KMS is needed to access KMS privately. Option D is correct because a key policy condition using kms:SourceVpc restricts usage to the VPC. Option B is wrong because bucket policy cannot restrict KMS key usage. Option C is wrong because IAM policy alone cannot restrict based on VPC for KMS; it's the key policy. Option E is wrong because a VPC endpoint for S3 does not restrict KMS calls.

Answer

Attach an IAM policy to the role that denies kms:Decrypt unless the request comes from the VPC.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Add a bucket policy condition to restrict access to the VPC.

Question 14

A company uses Amazon Redshift with encryption at rest using AWS KMS. They want to ensure that automated snapshots are encrypted with the same key and that cross-account snapshot sharing is secured. Which THREE steps should be taken?

Accepted Answer

Enable encryption on the Redshift cluster at creation time.. Option A is correct because Redshift automatically encrypts snapshots if the cluster is encrypted. Option C is correct because to share snapshots cross-account, the KMS key must allow the target account to decrypt. Option D is correct because Redshift uses a snapshot copy grant to authorize the destination account to use the key. Option B is wrong because separate key is not required; same key can be used if permissions allow. Option E is wrong because AWS Config rule doesn't enforce cross-account sharing security.

Answer

Create a new KMS key for snapshot encryption to isolate from the cluster key.

Answer

Enable AWS Config rule to detect unencrypted snapshots.

Question 15

A company needs to implement data protection for Amazon EFS file systems. Which TWO features should be configured?

Accepted Answer

Enable encryption in transit using TLS.. Option B is correct because EFS supports encryption at rest using KMS. Option D is correct because encryption in transit can be enforced using a mount option. Option A is wrong because EFS does not support versioning. Option C is wrong because EFS does not have Block Public Access; it uses security groups. Option E is wrong because EFS does not use lifecycle policies for data protection; they manage storage tiers.

Answer

Configure EFS Block Public Access.

Answer

Enable EFS versioning.

Answer

Configure EFS lifecycle management to transition files to Infrequent Access.