SCS-C02 Data Protection Practice Test 15 — 15 Questions

Question 1

A company uses S3 Server Access Logs to audit access to their S3 buckets. The security team wants to ensure that the log files themselves are encrypted at rest using SSE-KMS. Which configuration step is necessary?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a bucket policy on the destination bucket that grants the S3 log delivery service permission to use the KMS key. To encrypt S3 Server Access Logs at rest with SSE-KMS, you must add a bucket policy on the destination (log) bucket that grants the S3 log delivery service principal permission to use the KMS key. S3 log delivery writes logs as a service principal, so it needs explicit kms:GenerateDataKey and kms:Decrypt permissions on the key, plus s3:PutObject on the bucket. Without this, log delivery fails when the destination bucket uses SSE-KMS.

Answer

Use an S3 bucket policy to deny unencrypted uploads to the source bucket

Answer

Enable default encryption on the source bucket

Answer

Configure the destination bucket with a lifecycle policy

Question 2

A company wants to protect data in transit between an on-premises data center and Amazon S3. Which AWS service should be used to establish a dedicated, encrypted connection?

Accepted Answer

AWS Direct Connect with an IPsec VPN. AWS Direct Connect alone provides a dedicated private network path but does not encrypt traffic in transit. To achieve both a dedicated connection and encryption, you must pair Direct Connect with an IPsec VPN running over the dedicated link. This combination gives the private, consistent bandwidth of Direct Connect plus the encryption guarantees of IPsec, satisfying the requirement for encrypted data in transit.

Answer

AWS Direct Connect without VPN

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN over the internet

Question 3

A company is using AWS KMS to encrypt data in Amazon Redshift. They need to rotate the KMS key annually. Which approach meets the requirement with minimal operational impact?

Accepted Answer

Enable automatic key rotation on the KMS key. AWS KMS supports automatic annual key rotation for customer-managed KMS keys. Enabling this feature automatically rotates the key material once per year with no manual intervention, minimal operational overhead, and no impact on the Redshift cluster, which continues to use the same key ID.

Answer

Create a new KMS key each year and update the Redshift cluster to use the new key

Answer

Use an AWS Lambda function to rotate the key every year

Answer

Rotate the key by re-importing key material into an existing KMS key

Question 4

A company is designing a data protection strategy for Amazon S3. Which TWO of the following are valid methods to protect data at rest in S3?

Accepted Answer

Server-side encryption with S3-managed keys (SSE-S3). Options D and E are correct because both are encryption mechanisms that protect S3 object data at rest: SSE-S3 (D) encrypts objects with AES-256 keys fully managed by Amazon S3, while SSE-KMS (E) encrypts objects using keys managed in AWS KMS, giving you control over key policies, rotation, and audit trails via CloudTrail. These directly satisfy the requirement of protecting data at rest in S3. Option A (S3 Versioning) preserves multiple object versions to aid recovery from overwrites or deletions but does not encrypt data. Option B (S3 bucket policies) is an access-control mechanism governing who can perform actions on the bucket, not encryption at rest. Option C (MFA Delete) adds an authentication requirement for deleting versions or changing versioning state, which is a deletion-protection control rather than data-at-rest encryption.

Answer

S3 Versioning

Answer

S3 bucket policies

Answer

MFA Delete

Question 5

A company uses AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that integrity is verified. Which TWO services can be used together to achieve this?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation (option C) provides a built-in mechanism to verify that log files have not been modified, deleted, or tampered with after delivery. It uses SHA-256 hashing and digital signatures (based on RSA) to create a digest file that can be independently validated. AWS KMS (option D) allows you to encrypt CloudTrail log files at rest using server-side encryption (SSE-KMS), ensuring that the logs are stored in an encrypted format. Together, they meet both the encryption-at-rest and integrity verification requirements.

Answer

S3 Inventory

Answer

AWS CloudHSM

Answer

S3 MFA Delete

Question 6

A company is designing a data protection strategy for its Amazon RDS for PostgreSQL database. The database contains sensitive customer data. Compliance requirements mandate that all backups be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance using a customer managed KMS key. Enable automatic key rotation in KMS.. Enabling encryption at rest on the RDS instance with a customer managed KMS key gives the company control over the key, and enabling automatic key rotation in KMS satisfies the annual rotation requirement. Customer managed keys support automatic rotation (default 365 days), unlike AWS managed keys, which cannot be rotated on a customer-defined schedule.

Answer

Create an encrypted read replica of the RDS instance and use the replica for backups.

Answer

Use S3 server-side encryption with a customer managed key for automated backups. Configure lifecycle policies to rotate the key.

Answer

Enable encryption at rest on the RDS instance using an AWS managed KMS key. The key will be rotated automatically every year.

Question 7

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The application runs on Amazon EC2 instances and uses the PKCS#11 interface to interact with the HSM. The security team recently discovered that a former employee may have obtained a copy of the cryptographic materials from the HSM. What should the security team do to minimize the impact?

Accepted Answer

Delete the CloudHSM backup from the backup service. Then rotate all keys that were stored in the HSM.. Deleting the CloudHSM backup prevents the former employee from restoring the HSM's contents from a backup. Rotating all keys ensures that any keys the employee may have copied are no longer valid for encrypting/decrypting data, minimizing the impact of the exposure. Option A is incorrect because AWS KMS cannot manage keys stored in CloudHSM. Option C is incorrect because changing passwords does not invalidate cryptographic material that has already been copied. Option D is incorrect because deleting the HSM cluster alone does not delete the backup, and restoring from an old backup may reintroduce the compromised keys.

Answer

Use AWS KMS to create a new key and re-encrypt all data. Then revoke the old key.

Answer

Change the HSM administrator password and the crypto user passwords.

Answer

Delete the HSM cluster and create a new one. Restore the backup from a known good time.

Question 8

A company wants to encrypt data stored in Amazon S3 using server-side encryption with customer-provided keys (SSE-C). Which statement is correct regarding SSE-C?

Accepted Answer

The customer provides the encryption key in each request to S3.. SSE-C requires the customer to provide the encryption key and its MD5 digest in every PUT or GET request to Amazon S3. S3 uses the key to encrypt the object at rest and then discards the key; it is never stored by AWS. This ensures the customer retains full control over the encryption key material.

Answer

AWS manages the encryption keys.

Answer

The same encryption key is used for all objects in the bucket.

Answer

The encryption key is stored in AWS KMS.

Question 9

Which TWO of the following are valid methods to protect data in transit between an on-premises data center and AWS? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. Options B and E are correct. AWS Site-to-Site VPN creates an encrypted tunnel over the internet, protecting data in transit. AWS Direct Connect with MACsec provides encryption over a private physical connection. Option A is incorrect because CloudFront with HTTPS only encrypts between viewer and edge locations, not necessarily between the origin and edge, and it is not a method to connect on-premises directly to AWS. Option C is incorrect because VPC Peering does not encrypt traffic; it only routes between VPCs. Option D is incorrect because S3 Transfer Acceleration only speeds up transfers using edge locations but does not provide encryption.

Answer

Amazon CloudFront with HTTPS-only viewer protocol policy

Answer

VPC Peering

Answer

S3 Transfer Acceleration

Question 10

Which THREE of the following are required to use client-side encryption with Amazon S3 using AWS KMS? (Choose three.)

Accepted Answer

The encrypted data key is stored as metadata with the S3 object.. Option B is correct because with client-side encryption using the AWS SDK Encryption Client, the SDK generates a data key, encrypts the object locally, and stores the encrypted (wrapped) data key as metadata alongside the S3 object so it can be retrieved and unwrapped later. Option D is correct because the caller must have IAM permissions to invoke kms:GenerateDataKey (and typically kms:Decrypt) so the SDK can obtain a plaintext data key and a wrapped copy from AWS KMS. Option E is correct because client-side encryption is performed by the AWS SDK Encryption Client library (e.g., AmazonS3EncryptionClient), which handles key generation, local encryption, and metadata storage; S3 itself never sees plaintext. Option A is not required because a bucket policy forcing encryption governs server-side encryption at the S3 service level and is irrelevant to client-side encryption, which happens before data reaches S3. Option C is not required because the KMS key policy must grant the calling IAM principal (user or role) access to the key, not the S3 service, since S3 is not involved in the KMS operations for client-side encryption.

Answer

An S3 bucket policy that forces encryption.

Answer

A KMS key policy that allows the S3 service to decrypt.

Question 11

Which TWO of the following are valid options for encrypting data at rest in Amazon EBS? (Choose two.)

Accepted Answer

Enable EBS encryption by default using the AWS managed key for EBS.. Option A is correct because Amazon EBS supports account-level and Region-level encryption by default, which automatically encrypts new volumes and snapshots using the AWS managed key for EBS (aws/ebs) unless you specify a different key. Option B is correct because EBS encryption can be configured to use a customer managed KMS key, giving you control over key policies, rotation, and grants while still using the native EBS/KMS encryption mechanism. Option C is not a valid EBS at-rest encryption option because running an encryption script inside the EC2 instance is application-level or OS-level encryption, not native EBS volume encryption. Option D is not correct because CloudHSM is a separate HSM service and is not the mechanism used to generate or store EBS encryption keys; EBS encryption keys are managed through AWS KMS. Option E is not correct because S3 server-side encryption protects objects stored in S3, not EBS volumes or EBS snapshots.

Answer

Use an encryption script on the EC2 instance to encrypt the volume.

Answer

Use AWS CloudHSM to generate and store the encryption key.

Answer

Use S3 server-side encryption to encrypt the EBS snapshot.

Question 12

A company uses Amazon SQS to decouple its microservices. The messages contain personally identifiable information (PII). The security team requires that all messages be encrypted at rest. Currently, SQS is configured with SSE enabled using a customer managed KMS key. However, the team discovers that some messages are still being stored in plaintext in the dead-letter queue (DLQ) after the maximum receives are exceeded. The DLQ is also an SQS queue. What is the MOST likely reason?

Accepted Answer

The DLQ does not have SSE enabled, so messages are stored in plaintext.. SSE is configured per queue, not inherited. Enabling SSE with a customer-managed KMS key on the source queue does not automatically encrypt the DLQ; if the DLQ was created without SSE, messages moved there are stored using SQS's default (no encryption at rest) behavior, exposing the PII in plaintext. Each SQS queue, including a DLQ, must have its own encryption configuration.

Answer

The source queue's SSE is configured with AWS managed KMS key, which does not support cross-account DLQ.

Answer

The source queue's SSE configuration uses a different KMS key than the DLQ, causing decryption failure.

Answer

The KMS key policy does not allow the SQS service to decrypt the messages before moving them to the DLQ.

Question 13

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. However, the current KMS key policy does not allow rotation. Which action should the security team take to meet the requirement?

Accepted Answer

Use an AWS managed key instead of a customer managed key.. AWS managed keys are automatically rotated annually by AWS. This meets the requirement without needing to modify the existing key policy. Option A is wrong because manually rotating the key by creating a new key and updating the S3 bucket policy does not provide automatic rotation and is not the simplest solution. Option C is wrong because customer managed keys with imported key material do not support automatic rotation. Option D is wrong because the existing key policy does not allow rotation, so enabling automatic rotation on that key would fail; the correct approach is to use an AWS managed key.

Answer

Manually rotate the key by creating a new key and updating the S3 bucket policy.

Answer

Create a new customer managed key with imported key material and enable automatic rotation.

Answer

Enable automatic rotation on the existing customer managed key.

Question 14

A company needs to protect data at rest in Amazon S3. Which THREE server-side encryption mechanisms can be used to encrypt objects stored in S3?

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). The question asks for server-side encryption mechanisms for S3 objects, and three options qualify. Option A, SSE-S3, is correct because Amazon S3 manages the encryption keys and applies AES-256 encryption to objects at rest, requiring only the x-amz-server-side-encryption: AES256 header. Option B, SSE-KMS, is correct because it uses AWS KMS customer master keys (CMKs) to generate and manage data keys, providing auditability via CloudTrail and granular key policies. Option E, SSE-C, is correct because the customer supplies their own encryption key with each request, and S3 performs the encryption/decryption server-side without storing the key. Option C, Client-Side Encryption, is not a server-side mechanism since data is encrypted before it reaches S3. Option D, SSE-IAM, does not exist as an S3 encryption option; IAM manages permissions, not encryption keys.

Answer

Client-Side Encryption

Answer

Server-Side Encryption with IAM-Managed Keys (SSE-IAM)

Question 15

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that when an object is retrieved, it is automatically decrypted. They have configured the S3 bucket to use SSE-KMS with a customer managed key. However, when a user downloads an object using the AWS CLI, the object is still encrypted. The IAM policy for the user includes kms:Decrypt permission. What is the MOST likely reason for this issue?

Accepted Answer

The KMS key policy does not allow the user to decrypt.. The most likely reason is that the KMS key policy does not allow the user to decrypt. Even though the user's IAM policy includes kms:Decrypt, KMS requires that both the IAM policy and the key policy grant permission. Since the key policy is separate, it may not include the user as a principal. Option B is incorrect because SSE-C is not indicated. Option C is incorrect because s3:GetObject is needed but the issue is decryption. Option D is incorrect because encryption context is not required for automatic decryption via S3; S3 manages it transparently.

Answer

The user is using SSE-C instead of SSE-KMS.

Answer

The user does not have s3:GetObject permission.

Answer

The user is not specifying the correct encryption context in the request.