SCS-C02 Data Protection Practice Test 16 — 15 Questions

Question 1

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed KMS key. What should the team configure to enforce this requirement?

Accepted Answer

Add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws:kms header.. Option D is correct because using a bucket policy that denies PutObject if the request does not include the correct encryption header (aws:kms) ensures that any upload without KMS encryption is denied. Option A is wrong because enabling default encryption does not prevent unencrypted uploads; it applies encryption server-side but still allows uploads without explicit encryption headers. Option B is wrong because S3 Object Lock is for write-once-read-many protection, not encryption enforcement. Option C is wrong because enabling S3 Block Public Access does not enforce encryption.

Answer

Enable S3 Block Public Access.

Answer

Configure S3 Object Lock to require encryption.

Answer

Enable default encryption on the S3 bucket with AES-256.

Question 2

A company is migrating on-premises databases to Amazon RDS for MySQL. The security team requires that data be encrypted at rest and in transit. Which combination of steps should the team take to meet these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance and set the rds.force_ssl parameter to 1 in the DB parameter group.. Option D is correct because enabling encryption at rest on the RDS instance (which can be done during creation or via snapshot) and requiring SSL for connections (by setting the rds.force_ssl parameter to 1) meets both requirements. Option A is wrong because enabling encryption at rest alone does not cover in-transit. Option B is wrong because using a client-side encryption library is not a standard RDS feature. Option C is wrong because using an RDS proxy with TLS does not enforce SSL for direct connections.

Answer

Use an RDS proxy with TLS termination and enable encryption at rest.

Answer

Enable encryption at rest on the RDS instance and use a client-side encryption library.

Answer

Enable encryption at rest and configure the security group to allow only HTTPS traffic.

Question 3

A company uses AWS KMS to encrypt secrets stored in AWS Secrets Manager. The security team wants to audit all KMS key usage, including attempts to use the key without proper authorization. Which AWS service should the team use to meet this requirement?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail logs all KMS API calls, including Decrypt, Encrypt, GenerateDataKey, and any authorization failures. Option A is wrong because CloudWatch Logs is for monitoring log data, not for capturing API calls. Option C is wrong because Amazon GuardDuty is a threat detection service that does not log KMS API calls. Option D is wrong because AWS Config tracks resource configuration changes, not API calls.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 4

A company has an S3 bucket that stores financial records. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted with a specific AWS KMS key. The team creates a bucket policy that denies s3:PutObject unless the request includes the correct encryption header. However, some users who upload objects using the AWS Management Console report that their uploads fail. What is the most likely cause?

Accepted Answer

The console uses multipart uploads, which require encryption headers on each part.. Option A is correct because the AWS Management Console uses multipart uploads for large objects, and multipart uploads require the encryption header to be specified in each part upload. Option B is wrong because the bucket policy can enforce encryption; a KMS key policy is separate. Option C is wrong because S3 Transfer Acceleration does not affect encryption. Option D is wrong because the console respects bucket policies.

Answer

The KMS key policy does not allow the s3:PutObject operation.

Answer

The console does not support server-side encryption.

Answer

S3 Transfer Acceleration is enabled, which bypasses the bucket policy.

Question 5

A company uses AWS KMS to encrypt data in Amazon S3. The security team notices that some KMS key usage is not being logged in AWS CloudTrail. What is the most likely reason for this?

Accepted Answer

CloudTrail is not enabled in the region where the KMS key is used.. Option A is correct because CloudTrail does not log KMS key usage if the key is used in an AWS region where CloudTrail is not enabled. Option B is wrong because CloudTrail logs KMS operations regardless of whether they succeed. Option C is wrong because KMS key rotation generates new backing keys but does not affect logging. Option D is wrong because disabling CloudTrail log file validation does not stop logging.

Answer

The KMS key has automatic rotation enabled.

Answer

CloudTrail log file validation is disabled.

Answer

Only successful KMS operations are logged.

Question 6

A company uses Amazon EBS volumes for EC2 instances. The security team requires that all EBS volumes be encrypted at rest. The team creates an AWS Config rule to check whether EBS volumes are encrypted. However, some volumes are non-compliant even though they have encryption enabled. What is the most likely reason?

Accepted Answer

The volumes are not encrypted at the time of creation, even though encryption is enabled later.. Option D is correct because the AWS Config managed rule 'encrypted-volumes' checks if EBS volumes are encrypted, but it does not check the default encryption setting for the account; it only checks the volumes themselves. Option A is wrong because Config rules check the configuration, not the encryption key. Option B is wrong because the rule checks volumes, not snapshots. Option C is wrong because the rule does not check encryption keys.

Answer

The volumes were created from unencrypted snapshots.

Answer

The volumes are encrypted with a different KMS key than the one specified in the Config rule.

Answer

The Config rule is configured to check for a specific KMS key alias.

Question 7

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with Amazon S3-managed keys (SSE-S3). What is the minimum permission required for an IAM user to upload an object that will be encrypted with SSE-S3?

Accepted Answer

s3:PutObject. Option A is correct because SSE-S3 does not require any special permissions beyond s3:PutObject; S3 handles the encryption automatically. Option B is wrong because kms:GenerateDataKey is needed for SSE-KMS, not SSE-S3. Option C is wrong because s3:PutObjectAcl is for ACLs. Option D is wrong because kms:Decrypt is not needed for SSE-S3.

Answer

s3:PutObjectAcl

Answer

kms:Decrypt

Answer

kms:GenerateDataKey

Question 8

A company stores sensitive data in an S3 bucket and uses AWS KMS to encrypt the data. The security team wants to ensure that only specific IAM roles can decrypt the data. What should the team do?

Accepted Answer

Modify the KMS key policy to include a condition that allows kms:Decrypt only for the specific IAM roles.. Option D is correct because using a KMS key policy that grants kms:Decrypt only to the specific roles ensures that only those roles can decrypt. Option A is wrong because an S3 bucket policy controls access to S3 operations, not KMS decryption. Option B is wrong because an IAM policy that allows kms:Decrypt for all users would not restrict to specific roles. Option C is wrong because a KMS grant is a temporary permission, not a permanent policy.

Answer

Use a KMS grant to allow the roles to decrypt the key.

Answer

Attach an IAM policy to the roles that allows kms:Decrypt on the key.

Answer

Add an S3 bucket policy that denies s3:GetObject for all roles except the allowed ones.

Question 9

A company stores data in Amazon S3 and uses AWS KMS with Customer Master Keys (CMKs) for encryption. The security team wants to audit when the CMK is used to decrypt data. Which of the following will provide this information?

Accepted Answer

AWS CloudTrail. Option D is correct because AWS CloudTrail logs all KMS Decrypt API calls. Option A is wrong because S3 server access logs record requests to S3, not the KMS decryption calls. Option B is wrong because CloudWatch Logs can store logs but does not generate them. Option C is wrong because AWS Config records configuration changes, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

S3 server access logs

Question 10

A company wants to protect sensitive data stored in Amazon S3. Which TWO actions should the company take to meet this goal? (Choose TWO.)

Accepted Answer

Enable S3 Block Public Access.. Options B and D are correct. Option B: Enabling default encryption ensures that new objects are automatically encrypted. Option D: Using S3 Block Public Access prevents accidental public exposure. Option A is wrong because S3 Transfer Acceleration is for speed, not security. Option C is wrong because S3 event notifications are for automation, not protection. Option E is wrong because S3 Object Lock prevents deletion/modification, not unauthorized access.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure S3 event notifications to send events to Amazon SNS.

Answer

Enable S3 Object Lock.

Question 11

A company uses AWS KMS to encrypt data. The security team wants to ensure that KMS keys are not used outside of the company's AWS account. Which TWO measures would help achieve this? (Choose TWO.)

Accepted Answer

Add a key policy that denies kms:* operations for principals from other AWS accounts.. Options A and C are correct. Option A: Setting a key policy that denies use by external accounts prevents cross-account usage. Option C: Using key policies to restrict usage to specific IAM roles within the account ensures only authorized roles can use the key. Option B is wrong because disabling key rotation does not prevent cross-account use. Option D is wrong because enabling automatic rotation does not restrict usage. Option E is wrong because tagging keys does not prevent usage.

Answer

Tag the KMS key with the account ID.

Answer

Enable automatic key rotation.

Answer

Disable automatic key rotation.

Question 12

A company is designing a data protection strategy for Amazon S3. The compliance team requires that all objects be encrypted at rest and that any attempt to upload an unencrypted object be blocked. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Enable default encryption on the bucket with SSE-S3 or SSE-KMS.. Options A, B, and D are correct. Option A: Enabling default encryption ensures objects are encrypted at rest. Option B: Using a bucket policy to deny PutObject without encryption header blocks unencrypted uploads. Option D: Using S3 Block Public Access prevents public exposure. Option C is wrong because S3 Transfer Acceleration does not encrypt data. Option E is wrong because S3 Object Lock does not enforce encryption.

Answer

Enable S3 Object Lock.

Answer

Enable S3 Transfer Acceleration.

Question 13

Refer to the exhibit. An administrator applies this bucket policy to an S3 bucket. Which of the following statements describes the effect of this policy?

Accepted Answer

The policy denies all PutObject requests that do not specify SSE-KMS.. Option B is correct. The first statement denies PutObject if the encryption header is not 'aws:kms'. The second statement denies PutObject if the encryption header is null (absent). Together, they enforce that all uploads must use SSE-KMS. Option A is wrong because the policy does not allow unencrypted uploads. Option C is wrong because the policy does not allow SSE-S3. Option D is wrong because the policy does not allow no encryption.

Answer

The policy allows uploads without encryption but denies uploads with SSE-KMS.

Answer

The policy allows unencrypted uploads but denies uploads with SSE-KMS.

Answer

The policy allows uploads with SSE-S3 but denies uploads with SSE-KMS.

Question 14

Refer to the exhibit. A security engineer configures the above KMS key policy. The DataAccess role is used by an application that runs on EC2 instances in the us-east-1 region. The application needs to read encrypted objects from an S3 bucket in the same region. Which of the following is true about this configuration?

Accepted Answer

The role can decrypt objects in S3, but cannot use the key outside of S3.. Option A is correct. The condition 'kms:ViaService' restricts the use of the key to requests that originate from S3 in us-east-1. This means the role can only use the key when the request comes through S3 (e.g., S3 GetObject with SSE-KMS). Option B is wrong because the role can still encrypt data via S3 PutObject (GenerateDataKey). Option C is wrong because the condition allows usage via S3. Option D is wrong because the role does not have kms:Encrypt but has kms:GenerateDataKey, which is sufficient for S3 PutObject.

Answer

The role can use the key for any S3 operation in any region.

Answer

The role cannot use the key for any operation because the condition is invalid.

Answer

The role can only encrypt data, not decrypt it.

Question 15

Refer to the exhibit. A security engineer runs the above AWS CLI command to encrypt a secret file. The command succeeds and returns a base64-encoded ciphertext. Which of the following statements is correct?

Accepted Answer

The command returns a base64-encoded ciphertext that can be decrypted with the same KMS key.. Option C is correct. The command encrypts the plaintext file using the specified KMS key and returns the ciphertext as base64-encoded output. Option A is wrong because the command does not specify an encryption context; it's optional. Option B is wrong because the command uses fileb:// which reads binary data; it will succeed if the file exists. Option D is wrong because the output is the ciphertext, not a data key.

Answer

The command returns a plaintext data key and an encrypted copy.

Answer

The command will fail because fileb:// is not a valid prefix.

Answer

The command will fail because encryption context is required.