SCS-C02 Data Protection Practice Test 16 — 15 Questions

Question 1

A security engineer is configuring a new Amazon RDS for MySQL database. The compliance team requires that all database connections be encrypted in transit. Which configuration ensures this requirement is met?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the 'require_secure_transport' parameter in the DB parameter group. Setting the 'require_secure_transport' parameter to '1' in the DB parameter group forces all connections to the RDS for MySQL instance to use TLS/SSL encryption. This ensures that data in transit is encrypted, meeting the compliance requirement. The parameter enforces that only encrypted connections are accepted, rejecting any unencrypted attempts.

Answer

Enable encryption at rest using KMS

Answer

Enable IAM database authentication

Answer

Set the 'ssl' parameter to '1' in the DB parameter group

Question 2

A financial company uses AWS KMS to encrypt sensitive data. The security team notices that a KMS key has been deleted, but the encrypted data is still needed for a short period. What is the fastest way to make the data decryptable again?

Accepted Answer

Cancel the key deletion within the waiting period. When a KMS key is scheduled for deletion, there is a waiting period (7-30 days) during which the deletion can be cancelled, restoring the key and making the data decryptable. Option A is incorrect because AWS Support cannot recover a deleted KMS key. Option C is incorrect because CloudHSM backups are unrelated to KMS key material. Option D is incorrect because re-encrypting with a new key would require the original key to decrypt first.

Answer

Contact AWS Support to recover the key material

Answer

Restore the key from a CloudHSM backup

Answer

Re-encrypt the data with a new KMS key

Question 3

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation fails with an error indicating that the secret cannot be accessed. What is the most likely cause?

Accepted Answer

The Lambda rotation function lacks IAM permissions to update the secret. The rotation function must have IAM permissions to read the current secret, update it with new credentials, and modify the database password. If the Lambda function lacks those permissions, it cannot access or update the secret, causing rotation to fail.

Answer

The KMS key used to encrypt the secret is disabled

Answer

The secret is not encrypted

Answer

The secret is not in the same region as the database

Question 4

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team is concerned about key durability and wants to ensure that keys are not lost if the HSM fails. Which action should be taken?

Accepted Answer

Regularly back up the HSM to an Amazon S3 bucket and restore to a new cluster if needed. AWS CloudHSM supports taking backups of the HSM content to an Amazon S3 bucket. These backups can be used to restore to a new HSM cluster in case of failure, ensuring key durability. Option A is incorrect because CloudHSM clusters are single-region; multi-region clusters are not supported. Option B is incorrect because storing keys on an encrypted EBS volume bypasses the security of the HSM and is not a recommended practice for key durability. Option C is incorrect because AWS KMS cannot directly import keys from CloudHSM; KMS and CloudHSM are separate services with different key management capabilities.

Answer

Create a multi-region CloudHSM cluster

Answer

Store the keys in a file on an encrypted EBS volume

Answer

Use AWS KMS to import the keys from CloudHSM

Question 5

A company wants to encrypt data in transit between an on-premises data center and AWS over a VPN connection. Which AWS service or feature should be used?

Accepted Answer

AWS Site-to-Site VPN. WS Site-to-Site VPN (Option C). AWS Site-to-Site VPN creates encrypted tunnels between an on-premises data center and AWS, securing data in transit. Option A (AWS Route 53 Resolver) is a DNS resolution service and does not encrypt network traffic. Option B (AWS Certificate Manager, ACM) is used to provision and manage SSL/TLS certificates for applications, not for VPN encryption. Option D (Amazon API Gateway) is for creating and managing APIs, not for encrypting data in transit between sites.

Answer

AWS Route 53 Resolver

Answer

AWS Certificate Manager (ACM)

Answer

Amazon API Gateway

Question 6

Refer to the exhibit. An administrator is investigating why an application that uses KMS for encryption is failing. The IAM role used by the application has the following policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ] }. What is the most likely cause of the failure?

Accepted Answer

The KMS key is disabled. The KMS key is disabled. If the key is disabled, any attempt to use it for decryption will fail, even if the IAM policy allows the kms:Decrypt action. Option A is incorrect because if the key were deleted, the error would be different. Option B is incorrect because the policy does specify the correct key ARN. Option C is incorrect because the policy does allow the kms:Decrypt action.

Answer

The KMS key has been deleted

Answer

The IAM policy does not specify the correct key ARN

Answer

The IAM policy does not allow the kms:Decrypt action

Question 7

A company wants to protect sensitive data in Amazon S3 by ensuring that all objects are encrypted at rest. Which TWO options meet this requirement? (Choose TWO.)

Accepted Answer

Use server-side encryption with S3 managed keys (SSE-S3). Options A and D are correct because they are server-side encryption methods provided by S3 to encrypt objects at rest. SSE-S3 uses S3-managed keys, while SSE-KMS uses AWS KMS keys. Option B (SSL/TLS) protects data in transit, not at rest. Option C (client-side encryption) encrypts data before upload, but it is not an S3 server-side encryption feature and does not rely on S3 for encryption key management; thus it does not meet the requirement of S3 ensuring encryption at rest. Option E (Amazon Macie) is a data classification and discovery service, not an encryption mechanism.

Answer

Use SSL/TLS for data in transit

Answer

Use client-side encryption with the AWS Encryption SDK

Answer

Use Amazon Macie to classify and mask data

Question 8

A company is designing a data protection strategy for Amazon EBS volumes. Which TWO practices should be implemented? (Choose TWO.)

Accepted Answer

Enable encryption by default for new EBS volumes. For data protection of Amazon EBS volumes, enable encryption by default (A) to ensure all new volumes are encrypted. Regular snapshots of EBS volumes stored in a different region (D) provide disaster recovery capability. Option E (EBS multi-attach) is intended for high availability, not data protection, and does not directly protect data. Options B and C are incorrect: S3 Object Lock is for S3 objects, not EBS snapshots; automated backups for RDS are for RDS databases, not EBS volumes.

Answer

Use S3 Object Lock to prevent deletion of snapshots

Answer

Enable automated backups for Amazon RDS

Answer

Use EBS multi-attach for high availability

Question 9

A company runs a web application on Amazon EC2 behind an Application Load Balancer (ALB). The application handles payment card information (PCI) and must comply with PCI DSS. The security team wants to ensure that all data in transit between the client and the ALB is encrypted using TLS 1.2 or higher. The ALB currently uses a default certificate from AWS Certificate Manager (ACM) that was issued by Amazon. The compliance team has flagged that the certificate must be issued by a public Certificate Authority (CA) that is trusted by major browsers. The company wants to minimize operational overhead. What should the security team do?

Accepted Answer

Request a public certificate from ACM and associate it with the ALB. AWS Certificate Manager (ACM) can issue public certificates from trusted certificate authorities (CAs) such as Amazon Trust Services at no additional cost. These certificates support TLS 1.2 and 1.3 and are automatically renewed, minimizing operational overhead. ACM public certificates are trusted by major browsers because they are issued by a public CA. Option A is incorrect because CloudHSM is used for hardware-based key management, not for issuing public certificates; importing a certificate from CloudHSM would require manual renewal. Option B is incorrect because CloudFront's default certificate is for CloudFront distributions, not for ALBs; using CloudFront would introduce unnecessary complexity and cost. Option C is incorrect because self-signed certificates are not trusted by browsers and would require manual renewal and distribution.

Answer

Use AWS CloudHSM to generate a certificate and import it into ACM

Answer

Configure CloudFront in front of the ALB and use a CloudFront default certificate

Answer

Generate a self-signed certificate on the EC2 instance and upload it to ACM, then associate it with the ALB

Question 10

A company uses Amazon S3 to store sensitive documents. The security engineer notices that an S3 bucket named 'documents-prod' has been configured with a bucket policy that allows s3:PutObject from any principal, but only if the request includes the x-amz-server-side-encryption header set to 'AES256'. The company's security policy requires that all objects be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). The engineer needs to ensure that any new objects uploaded to the bucket are encrypted with SSE-KMS, and that existing objects remain accessible. What should the engineer do?

Accepted Answer

Update the bucket policy to require the x-amz-server-side-encryption header set to 'aws:kms' and specify the desired KMS key ARN. Updating the bucket policy to require the x-amz-server-side-encryption header set to 'aws:kms' and specifying the desired KMS key ARN enforces that all new uploads use SSE-KMS. Existing objects are not affected by the policy change and remain accessible. Option A is incorrect because creating a new bucket and migrating objects is unnecessary and more complex; the existing bucket can be updated directly. Option B is incorrect because modifying the bucket's default encryption only sets a default encryption method but does not enforce it via policy; users can still upload without specifying encryption and the default will apply, but if they specify a different encryption header, it might override. Option D is incorrect because S3 Object Lock and lifecycle policies do not enforce encryption requirements during upload; they only manage object retention and expiration.

Answer

Create a new bucket with a bucket policy that requires SSE-KMS, and migrate all objects using S3 Batch Operations

Answer

Modify the bucket's default encryption configuration to use SSE-KMS

Answer

Enable S3 Object Lock on the bucket to prevent overwrites, and use a lifecycle policy to expire objects that are not encrypted with SSE-KMS

Question 11

A company uses Amazon RDS for MySQL to store customer data. The security team wants to ensure that the database is encrypted at rest. The database is already running and contains production data. The team needs to enable encryption at rest with minimal downtime. What should they do?

Accepted Answer

Create a read replica with encryption enabled, promote it to a standalone instance, and update the application connection string. You cannot enable encryption on an existing RDS instance; you must create a new encrypted instance and migrate. Option B is wrong because you cannot modify the existing instance to add encryption. Option C is wrong because snapshots can be encrypted, but you still need to restore to a new instance. Option D is wrong because you cannot attach encrypted storage.

Answer

Attach an encrypted EBS volume to the RDS instance

Answer

Take a snapshot of the database, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new instance

Answer

Modify the existing DB instance and enable encryption using the AWS CLI

Question 12

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which policy configuration should be used?

Accepted Answer

Add a bucket policy with a condition that the kms:ViaService is s3.amazonaws.com. The bucket policy can include a condition using the kms:ViaService condition key set to s3.amazonaws.com, which ensures that decryption requests must come through S3. This allows only requests that originate from S3 (e.g., when the IAM role accesses the bucket) to decrypt, provided the role also has kms:Decrypt permission. Option A is incorrect because S3 access point policies control access to the access point, not KMS decryption. Option B is incorrect because source IP conditions do not restrict decryption to S3; they restrict based on IP address, which is not the requirement. Option C is incorrect because a KMS grant is typically used to delegate temporary access to another AWS principal, not to restrict a specific IAM role; a key policy with a principal condition is more appropriate.

Answer

Use an S3 access point policy to restrict access

Answer

Attach an IAM policy to the role that allows kms:Decrypt with a condition on the source IP

Answer

Create a KMS grant for the IAM role with Decrypt permission

Question 13

A financial services company must ensure that all data written to Amazon S3 is encrypted at rest and that the encryption keys are rotated every 90 days. The company also needs to maintain an audit trail of when keys were used. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use SSE-C with customer-provided keys and rotate keys using a Lambda function. (SSE-C with customer-provided keys and rotate keys using a Lambda function) is correct because it allows the company to enforce a 90-day key rotation schedule by using a custom Lambda function, which meets the requirement with relatively low operational overhead compared to fully manual solutions. SSE-C provides encryption at rest, and key usage can be audited via S3 server access logs and CloudTrail. Option A (SSE-S3) is incorrect because it does not support customer-controlled key rotation. Option C (SSE-KMS with automatic key rotation) is incorrect because automatic rotation occurs only once per year (365 days), not every 90 days as required. Option D (client-side encryption with the AWS Encryption SDK) is incorrect because it requires custom key management and rotation, increasing operational overhead.

Answer

Use SSE-S3 with default encryption enabled

Answer

Use SSE-KMS with a customer managed key and enable automatic key rotation

Answer

Use client-side encryption with the AWS Encryption SDK

Question 14

A company is designing a disaster recovery plan for its Amazon RDS for MySQL database. The database must be encrypted at rest. Which approach ensures that the database is encrypted and can be restored in another AWS Region?

Accepted Answer

Create a cross-Region read replica with encryption enabled. (Create a cross-Region read replica with encryption enabled) is correct because it continuously replicates data to another AWS Region and encryption at rest can be enabled, ensuring both disaster recovery and encryption. Option A is wrong because encryption cannot be enabled on an existing unencrypted DB instance; a new encrypted instance must be created. Option B is wrong because exporting to S3 and using cross-Region replication does not provide a real-time database replica and complicates recovery. Option C is wrong because while a manual snapshot can be copied to another Region with encryption, it does not provide continuous replication; it is a point-in-time backup, not a disaster recovery solution that minimizes data loss.

Answer

Enable encryption on the existing DB instance

Answer

Export the database to Amazon S3 and use S3 cross-Region replication

Answer

Create a manual snapshot and copy it to another Region with encryption

Question 15

A company uses Amazon EBS volumes for EC2 instances. Security policy requires that all EBS volumes be encrypted at rest. The company already has a default KMS key for EBS encryption. However, some new volumes are created without encryption. What is the most efficient way to enforce encryption for all new EBS volumes?

Accepted Answer

Enable EBS encryption by default in the EC2 console or via the API. The most efficient way to enforce encryption for all new EBS volumes is to enable EBS encryption by default at the account level (Option D). This setting ensures that any new volume created is automatically encrypted using the default KMS key, without requiring manual intervention or additional monitoring. Option A (CloudTrail alerts) is reactive and does not enforce encryption. Option B (AWS Config rule with Lambda) is a detective/remedial approach that adds complexity. Option C (custom AMI) is not scalable and does not cover volumes launched from other AMIs.

Answer

Use AWS CloudTrail to monitor volume creation and send alerts

Answer

Create an AWS Config rule to detect unencrypted volumes and trigger a Lambda function to encrypt them

Answer

Use a custom AMI that enforces encryption