SCS-C02 Data Protection Practice Test 16 — 15 Questions

Question 1

A company is storing sensitive data in Amazon S3 buckets. They want to ensure that all uploaded objects are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Which bucket policy statement will enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}}. It uses a Deny effect with a StringNotEquals condition on the s3:x-amz-server-side-encryption header set to 'aws:kms'. This ensures that any PutObject request that does not include the header specifying SSE-KMS is denied, effectively enforcing that all uploaded objects must be encrypted with AWS KMS. The Deny effect overrides any Allow, making this policy robust against accidental or malicious uploads without the required encryption.

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "AES256"}}}

Answer

{"Effect": "Allow", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}}

Question 2

A company uses AWS KMS to encrypt data in Amazon RDS. They need to ensure that the key material is automatically rotated every year. Which key type should they use?

Accepted Answer

AWS managed key. AWS managed keys (D) are automatically rotated every year by AWS without any action required from the customer. For Amazon RDS encryption using AWS KMS, the default key (aws/rds) is an AWS managed key that supports automatic annual rotation, meeting the requirement exactly. Customer managed keys (B) also support automatic rotation, but the question specifies 'every year' and AWS managed keys are the simplest choice that satisfies this, as they are automatically rotated annually by default.

Answer

Custom key store

Answer

Customer managed key

Answer

AWS owned key

Question 3

A company needs to encrypt data at rest in Amazon Redshift. They want to use an AWS KMS customer managed key. What is the correct procedure to enable encryption for an existing Redshift cluster?

Accepted Answer

Take a snapshot of the cluster, restore it to a new cluster with encryption enabled, and point applications to the new cluster.. Amazon Redshift does not support enabling encryption on an existing cluster directly. The only way to transition an unencrypted cluster to an encrypted one is to take a snapshot of the cluster, restore it to a new cluster with encryption enabled using a KMS customer managed key, and then redirect applications to the new cluster. This is because encryption settings are immutable after cluster creation.

Answer

Enable encryption using the Redshift console by selecting the KMS key.

Answer

Use the AWS CLI command 'aws redshift modify-cluster' with --encrypted flag.

Answer

Modify the cluster and enable encryption with the KMS key.

Question 4

A company has an Amazon S3 bucket with versioning enabled. They want to ensure that all objects in the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). They also want to prevent any future uploads that are not encrypted with SSE-KMS. Which combination of actions should they take?

Accepted Answer

Add a bucket policy that denies s3:PutObject if s3:x-amz-server-side-encryption is not aws:kms. Use S3 Inventory to report encryption status of existing objects.. A bucket policy denying PutObject without SSE-KMS prevents non-compliant uploads, and S3 Inventory reports encryption status. Option B only checks compliance, does not enforce. Option C does not enforce encryption. Option D does not enforce.

Answer

Use AWS Config rule s3-bucket-server-side-encryption-enabled to check compliance.

Answer

Use S3 Object Lock with governance mode.

Answer

Enable default encryption with SSE-KMS on the bucket. Use S3 Inventory to report encryption status.

Question 5

A company uses AWS Secrets Manager to store database credentials. They need to rotate the secrets automatically every 30 days. Which rotation strategy should they use?

Accepted Answer

Enable automatic rotation in Secrets Manager and specify a Lambda rotation function.. AWS Secrets Manager natively supports automatic rotation of secrets, and you must specify an AWS Lambda function to perform the rotation logic (e.g., updating the database password and storing the new secret). This ensures the secret is rotated on a schedule (every 30 days) without manual intervention, meeting the requirement for automated rotation.

Answer

Use AWS Systems Manager Parameter Store to rotate the secret.

Answer

Manually update the secret every 30 days.

Answer

Use an AWS Config rule to trigger rotation.

Question 6

A company stores sensitive data in an Amazon S3 bucket. They want to ensure that data is encrypted in transit when accessed from the internet. Which policy should they attach to the bucket?

Accepted Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"Bool": {"aws:SecureTransport": "false"}}}. It uses a Deny effect with the aws:SecureTransport condition set to 'false', which explicitly blocks any request that does not use HTTPS/TLS. This ensures that all S3 operations (s3:*) on the bucket objects require encryption in transit, as any HTTP request will be denied. The Deny effect overrides any Allow, making this a robust policy to enforce encrypted access from the internet.

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringNotEquals": {"aws:SourceVpc": "vpc-12345"}}}

Answer

{"Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"Bool": {"aws:SecureTransport": "false"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"IpAddress": {"aws:SourceIp": "0.0.0.0/0"}}}

Question 7

A company uses AWS KMS to encrypt EBS volumes. They want to ensure that the key used for EBS encryption is not shared across different AWS accounts. Which feature should they use?

Accepted Answer

Configure the key policy to deny access to any principal from another AWS account.. AWS KMS key policies can explicitly deny access to principals from other AWS accounts by using the `aws:SourceAccount` or `aws:SourceArn` condition keys, or by specifying a `Deny` statement with a condition that checks the account ID. This ensures that the KMS key used for EBS encryption cannot be used by any IAM principal or role from a different AWS account, preventing cross-account key sharing.

Answer

Use a CloudHSM custom key store.

Answer

Use the key's alias to restrict access.

Answer

Enable automatic key rotation.

Question 8

Which TWO AWS services can be used to monitor and audit data access patterns to Amazon S3 buckets? (Choose 2.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (C) is correct because it records S3 data-plane API calls such as GetObject and PutObject when data events are enabled, providing an audit trail of who accessed which objects and when. Amazon S3 Server Access Logs (D) is correct because S3 can deliver detailed, per-request access records (requester, bucket, operation, HTTP status, bytes) directly to a target bucket for auditing access patterns. AWS Config (A) tracks resource configuration changes and compliance, not object-level data access patterns. AWS CloudWatch (B) provides metrics, logs, and alarms but does not natively audit S3 object access requests. AWS Trusted Advisor (E) offers best-practice checks and recommendations, not access auditing.

Answer

AWS Config

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Question 9

Which TWO AWS services provide key management for encryption at rest? (Choose 2.)

Accepted Answer

AWS CloudHSM. AWS Key Management Service (KMS) is a managed service that makes it easy to create and control customer master keys (CMKs) used for encrypting data at rest across AWS services like S3, EBS, and RDS. AWS CloudHSM provides dedicated hardware security modules (HSMs) that allow you to manage your own encryption keys in a tamper-resistant hardware appliance, meeting FIPS 140-2 Level 3 compliance for key storage and cryptographic operations. Both services directly provide key management for encryption at rest, with KMS offering integrated key rotation and auditing via AWS CloudTrail, while CloudHSM gives you full control over the HSM appliance and keys.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Certificate Manager (ACM)

Answer

AWS Secrets Manager

Question 10

A security engineer runs the command shown in the exhibit. What is the primary purpose of this command?

Accepted Answer

To encrypt the contents of secret.txt using a KMS key and store the result in encrypted_secret.txt.. The command shown in the exhibit is 'aws kms encrypt --key-id <key-id> --plaintext fileb://secret.txt --output text --query CiphertextBlob | base64 --decode > encrypted_secret.txt'. This command uses the AWS KMS Encrypt API to encrypt the contents of secret.txt with the specified KMS key, then decodes the base64-encoded ciphertext and writes it to encrypted_secret.txt. Therefore, the primary purpose is to encrypt the file contents using a KMS key and store the result in encrypted_secret.txt.

Answer

To generate a data key without plaintext.

Answer

To re-encrypt an existing encrypted file under a new key.

Answer

To decrypt the file secret.txt using a KMS key.

Question 11

A security engineer applies the bucket policy shown in the exhibit to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows uploads only if they use SSE-KMS.. The bucket policy shown in the exhibit uses a Deny effect with a condition that checks whether the s3:x-amz-server-side-encryption header does not equal aws:kms, which means any upload request that does not specify SSE-KMS encryption is denied. Therefore, the policy effectively allows uploads only if they use SSE-KMS. This is a common pattern to enforce encryption at rest with a specific KMS key type.

Answer

Allows uploads only if they use SSE-S3.

Answer

Allows uploads without encryption.

Answer

Allows uploads with any server-side encryption.

Question 12

A security engineer runs the command shown in the exhibit. What is the outcome?

Accepted Answer

Default encryption is enabled on the bucket using SSE-S3.. The command `aws s3api put-bucket-encryption --bucket my-bucket --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'` enables default encryption on the bucket using SSE-S3, because `AES256` is the algorithm identifier for SSE-S3 (Amazon S3-managed keys). The command succeeds and sets the default encryption configuration to use server-side encryption with S3-managed keys, which is the standard SSE-S3 behavior.

Answer

The command fails because AES256 is not a valid algorithm.

Answer

Default encryption is enabled on the bucket using SSE-KMS.

Answer

The command removes default encryption from the bucket.

Question 13

A security engineer is designing a solution to protect sensitive data in an Amazon RDS for MySQL database. The data must be encrypted at rest using a key stored in AWS KMS. Additionally, the database must support automated backups and cross-region disaster recovery. Which architecture meets these requirements?

Accepted Answer

Launch an encrypted RDS instance using a customer-managed KMS key. Enable automated backups and create a cross-region read replica.. Launching an encrypted RDS instance with a customer-managed KMS key satisfies the encryption-at-rest requirement with control over key rotation and access. Enabling automated backups ensures point-in-time recovery, and creating a cross-region read replica provides cross-region disaster recovery — all requirements are met in a single architecture.

Answer

Launch an unencrypted RDS instance, then use AWS DMS to replicate data to an encrypted instance in another region.

Answer

Launch an unencrypted RDS instance, then enable encryption using the AWS Console after creation.

Answer

Launch an encrypted RDS instance using the default KMS key, then export the database to S3 and copy to another region.

Question 14

A company wants to securely share an Amazon S3 object with an external partner. The partner needs to download the object using an HTTP GET request. The object must be accessible for only 24 hours. What is the most secure way to grant access?

Accepted Answer

Generate a presigned URL for the object with an expiration of 24 hours.. A presigned URL grants time-limited, secure access to a specific S3 object without exposing AWS credentials. The partner can download the object via HTTP GET within the 24-hour expiration window. Option A is incorrect because sharing IAM user credentials is insecure and provides broader access than needed. Option B is incorrect because making the object public exposes it to anyone, violating security. Option D is incorrect because creating an IAM user is unnecessary; the presigned URL alone provides the required access, and adding a user credential undermines security.

Answer

Create a new IAM user with read access to the object and share the access key and secret key.

Answer

Make the object publicly readable and share the object URL.

Answer

Create a new IAM user with read access to the object, then generate a presigned URL for the object.

Question 15

A company runs a web application on Amazon EC2 instances that processes credit card data. The application must store the data in an encrypted format. The security team wants to minimize the performance impact of encryption and offload the encryption operations to a dedicated hardware security module (HSM). Which solution should the architect choose?

Accepted Answer

Use AWS CloudHSM to perform encryption operations from the application.. AWS CloudHSM provides dedicated hardware security modules that can perform cryptographic operations, including encryption, offloading the work from the application's CPU. It is designed for applications that require dedicated HSM hardware for compliance or performance reasons. Using CloudHSM allows the application to call the HSM for encryption, minimizing performance impact on the EC2 instance.

Answer

Use Amazon EBS encryption on the EC2 instance's root volume.

Answer

Use the Linux dm-crypt utility to encrypt the data at the application level.

Answer

Use AWS KMS with a customer-managed key to encrypt the data in the application.