SCS-C02 Data Protection Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. A security engineer is reviewing the key policy for a customer managed key. The engineer notices that a user with the IAM role 'Admin' can encrypt and decrypt data using this key. However, the engineer wants to ensure that only requests coming from the company's VPC (vpc-12345678) can use the key. What should be added to the key policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a condition aws:SourceVpc with value vpc-12345678 to the 'Allow use of the key' statement. To restrict key usage to a specific VPC, you must add a condition using the aws:SourceVpc key to the 'Allow use of the key' statement in the key policy. Option C correctly accomplishes this. Option A is incorrect because kms:ViaService restricts usage to a specific AWS service endpoint, not a VPC. Option B is incorrect because kms:CallerAccount is not a valid condition key for KMS. Option D is incorrect because adding a Deny statement could conflict with the Allow statement and is not the recommended approach.

Answer

Add a condition kms:ViaService with value s3.amazonaws.com

Answer

Add a condition kms:CallerAccount with value 111122223333

Answer

Add a new statement with Effect: Deny and a condition aws:SourceVpc not equal to vpc-12345678

Question 2

Refer to the exhibit. A security engineer is reviewing the key policy for a customer managed key. The engineer notices that a user with the IAM role 'Admin' can encrypt and decrypt data using this key. However, the engineer wants to ensure that only requests coming from the company's VPC (vpc-12345678) can use the key. What should be added to the key policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the bucket encryption configuration to use SSEAlgorithm: aws:kms and specify a KMS key ID. The current bucket encryption configuration uses SSE-S3 (AES256). To meet the policy requiring KMS with a customer managed key, the engineer must update the bucket's default encryption settings to use SSE-KMS (aws:kms) and specify the KMS key ID. Option C correctly describes this. Option A is incorrect because enabling the bucket key with SSE-S3 does not change the encryption algorithm to KMS. Option B is incorrect because client-side encryption with a KMS key is not a bucket-level configuration; it is applied by the client before upload and does not modify the default server-side encryption setting. Option D is incorrect because adding a bucket policy that requires kms:Encrypt permission for PutObject requests does not enforce server-side encryption with KMS; it only authorizes KMS encryption if used, but objects could still be uploaded without specifying KMS encryption.

Answer

Enable the bucket key and set SSEAlgorithm to AES256

Answer

Use client-side encryption with a KMS key

Answer

Add a bucket policy that requires kms:Encrypt permission for all PutObject requests

Question 3

Refer to the exhibit. A security engineer is reviewing the key policy for a customer managed key. The engineer notices that a user with the IAM role 'Admin' can encrypt and decrypt data using this key. However, the engineer wants to ensure that only requests coming from the company's VPC (vpc-12345678) can use the key. What should be added to the key policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a condition to the KMS key policy that uses kms:ViaService to restrict encryption/decryption to logs.amazonaws.com and a condition that the Lambda function is the source. To ensure only the Lambda service can write logs and only a specific IAM role can read logs, you need to use KMS key policy conditions. The key policy should include a condition that allows CloudWatch Logs to use the key for encryption/decryption only when the request originates from the Lambda service (using kms:ViaService condition). Additionally, you can restrict read access by specifying the IAM role in the key policy. Option A is incorrect because resource-based policies on log groups cannot restrict write access to Lambda only; they are typically used for cross-account access. Option B is incorrect because S3 bucket policies are not applicable to CloudWatch Logs. Option C is incorrect because you cannot assign an IAM role to a log group; IAM roles are assumed by entities, not assigned to resources.

Answer

Attach a resource-based policy to the log group that allows only the Lambda service to write logs

Answer

Create an S3 bucket policy to allow only Lambda to write to the log group

Answer

Assign an IAM role to the log group that has permission to write logs

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. Security team wants to ensure that only specific IAM roles can decrypt objects. Which KMS key policy configuration should be used?

Accepted Answer

In the key policy, use a Condition block with kms:ViaService set to s3.<region>.amazonaws.com and allow kms:Decrypt for the role.. Using a kms:ViaService condition in the key policy restricts the key usage to requests coming from Amazon S3, and the IAM role's permissions to decrypt are granted via the key policy, ensuring only that role can decrypt via S3. Option A is wrong because without the key policy granting decrypt to the role, the IAM policy alone is insufficient. Option B is wrong because it grants blanket decrypt access to the role without the S3 service restriction, allowing decryption outside S3. Option C is wrong because grants are not the recommended way to control access for IAM roles with S3; key policies with conditions are more appropriate.

Answer

Attach an IAM policy to the role that allows kms:Decrypt, and leave the KMS key policy with default settings.

Answer

In the key policy, use a Principal element specifying the role ARN, and allow kms:Decrypt.

Answer

Use a grant for the role to allow kms:Decrypt for S3 operations.

Question 5

A company needs to protect data at rest on Amazon EBS volumes attached to EC2 instances. Which solution provides the most control over the encryption keys?

Accepted Answer

Use a customer managed KMS key with EBS encryption.. Using a customer managed KMS key allows the customer to control key rotation, policies, and access, providing the most control over encryption keys. Option B is wrong because client-side encryption requires application changes and does not leverage KMS for control. Option C is wrong because AWS managed keys do not allow customer control over key policies or rotation. Option D is wrong because enabling EBS encryption by default uses AWS managed keys unless a customer managed key is specified, thus not providing the most control.

Answer

Encrypt data using client-side encryption before writing to EBS.

Answer

Use an AWS managed KMS key for EBS encryption.

Answer

Enable EBS encryption by default in the account.

Question 6

A company stores sensitive data in Amazon DynamoDB and uses AWS KMS with a customer managed key for encryption. The security team wants to ensure that only specific applications can access the table data. Which policy configuration should be used?

Accepted Answer

In the KMS key policy, allow the role to decrypt with a condition kms:ViaService = dynamodb.<region>.amazonaws.com.. The kms:ViaService condition restricts the key usage to DynamoDB, and the key policy grants the role permission to decrypt using that condition, ensuring only applications using DynamoDB can decrypt. Option A is incorrect because simply allowing kms:Decrypt in the key policy without a service condition does not restrict usage to DynamoDB; any application with that role could decrypt. Option C is wrong because KMS grants are not typically used for service-level restrictions and do not provide the same control as a key policy with conditions. Option D is incorrect because an IAM policy granting DynamoDB and KMS actions does not restrict that the KMS key is only used via DynamoDB; the key policy must also allow it, and the condition is needed.

Answer

In the KMS key policy, allow the application role to perform kms:Decrypt.

Answer

Use a KMS grant to allow the application to use the key.

Answer

Attach an IAM policy to the application role allowing dynamodb:GetItem and kms:Decrypt.

Question 7

A company is using AWS KMS to encrypt data in Amazon S3. They need to ensure that the KMS key can only be used from within a specific VPC. Which TWO actions should be taken?

Accepted Answer

Create a VPC endpoint for AWS KMS.. A VPC endpoint for AWS KMS allows KMS API calls to be routed through the VPC, ensuring traffic does not traverse the public internet. Option E is correct because you can modify the KMS key policy to include a condition using the kms:SourceVpc key, which restricts use of the KMS key to requests originating from the specified VPC. Option B is incorrect because IAM policies cannot directly restrict based on VPC for KMS; such restrictions must be in the key policy. Option C is incorrect because a VPC endpoint for Amazon S3 does not restrict KMS calls. Option D is incorrect because S3 bucket policies control access to S3 objects, not KMS key usage.

Answer

Attach an IAM policy to the role that denies kms:Decrypt unless the request comes from the VPC.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Add a bucket policy condition to restrict access to the VPC.

Question 8

A company uses Amazon Redshift with encryption at rest using AWS KMS. They want to ensure that automated snapshots are encrypted with the same key and that cross-account snapshot sharing is secured. Which THREE steps should be taken?

Accepted Answer

Enable encryption on the Redshift cluster at creation time.. Options A, C, and D are correct. Option A is correct because Amazon Redshift automatically encrypts snapshots with the same KMS key used for the cluster when encryption is enabled at creation. Option C is correct because to share snapshots cross-account, the KMS key policy must grant the target account permission to decrypt using the key. Option D is correct because a snapshot copy grant is required to authorize the target account to use the KMS key for encrypted snapshot sharing. Option B is incorrect because a separate key is not necessary; the same key can be used if proper permissions are set. Option E is incorrect because AWS Config rules can detect unencrypted snapshots but do not directly enforce cross-account sharing security.

Answer

Create a new KMS key for snapshot encryption to isolate from the cluster key.

Answer

Enable AWS Config rule to detect unencrypted snapshots.

Question 9

A company needs to implement data protection for Amazon EFS file systems. Which TWO features should be configured?

Accepted Answer

Enable encryption in transit using TLS.. Options C and E are correct. For data protection, EFS supports encryption in transit using TLS (option C) and encryption at rest using AWS KMS (option E). Option A is incorrect because EFS uses security groups for network access control, not Block Public Access which is an S3 feature. Option B is wrong because EFS does not support versioning. Option D is incorrect because lifecycle management transitions files to Infrequent Access for cost optimization, not data protection.

Answer

Configure EFS Block Public Access.

Answer

Enable EFS versioning.

Answer

Configure EFS lifecycle management to transition files to Infrequent Access.

Question 10

A company is migrating on-premises databases to Amazon RDS for MySQL. The security team requires that data be encrypted at rest and in transit. Which combination of steps should the team take to meet these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance and set the rds.force_ssl parameter to 1 in the DB parameter group.. Enabling encryption at rest on the RDS instance (which can be done during creation or via a snapshot copy with encryption enabled) and requiring SSL for connections (by setting the rds.force_ssl parameter to 1 in the DB parameter group) ensures data is encrypted both at rest and in transit. Option A is incorrect because an RDS proxy with TLS termination does not enforce encryption for direct connections to the database, and encryption at rest alone does not cover in-transit. Option C is incorrect because using a client-side encryption library is not a standard RDS feature and would require application changes; it does not provide at-rest encryption managed by RDS. Option D is incorrect because configuring the security group to allow only HTTPS traffic is for HTTP-based services, not for MySQL connections; MySQL uses a different protocol, and HTTPS does not apply to database connections.

Answer

Use an RDS proxy with TLS termination and enable encryption at rest.

Answer

Enable encryption at rest on the RDS instance and use a client-side encryption library.

Answer

Enable encryption at rest and configure the security group to allow only HTTPS traffic.

Question 11

A company has an S3 bucket that stores financial records. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted with a specific AWS KMS key. The team creates a bucket policy that denies s3:PutObject unless the request includes the correct encryption header. However, some users who upload objects using the AWS Management Console report that their uploads fail. What is the most likely cause?

Accepted Answer

The console uses multipart uploads, which require encryption headers on each part.. The AWS Management Console uses multipart uploads for large objects, and multipart uploads require the encryption header to be specified in each part upload. Option B is wrong because the bucket policy can enforce encryption; a KMS key policy is separate. Option C is wrong because S3 Transfer Acceleration does not affect encryption. Option D is wrong because the console respects bucket policies.

Answer

The KMS key policy does not allow the s3:PutObject operation.

Answer

The console does not support server-side encryption.

Answer

S3 Transfer Acceleration is enabled, which bypasses the bucket policy.

Question 12

A company uses AWS KMS to encrypt data in Amazon S3. The security team notices that some KMS key usage is not being logged in AWS CloudTrail. What is the most likely reason for this?

Accepted Answer

CloudTrail is not enabled in the region where the KMS key is used.. CloudTrail does not log KMS key usage if the key is used in an AWS region where CloudTrail is not enabled. Option B is wrong because CloudTrail logs KMS operations regardless of whether they succeed. Option C is wrong because KMS key rotation generates new backing keys but does not affect logging. Option D is wrong because disabling CloudTrail log file validation does not stop logging.

Answer

The KMS key has automatic rotation enabled.

Answer

CloudTrail log file validation is disabled.

Answer

Only successful KMS operations are logged.

Question 13

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with Amazon S3-managed keys (SSE-S3). What is the minimum permission required for an IAM user to upload an object that will be encrypted with SSE-S3?

Accepted Answer

s3:PutObject. (s3:PutObject) is correct. SSE-S3 does not require any special permissions beyond s3:PutObject; S3 handles the encryption automatically. Option A (s3:PutObjectAcl) is wrong because it is for managing object ACLs, not for uploading. Option B (kms:Decrypt) is wrong because it is not needed for SSE-S3; kms:Decrypt is used for decryption with KMS. Option D (kms:GenerateDataKey) is wrong because it is needed for SSE-KMS, not SSE-S3.

Answer

s3:PutObjectAcl

Answer

kms:Decrypt

Answer

kms:GenerateDataKey

Question 14

A company stores sensitive data in an S3 bucket and uses AWS KMS to encrypt the data. The security team wants to ensure that only specific IAM roles can decrypt the data. What should the team do?

Accepted Answer

Modify the KMS key policy to include a condition that allows kms:Decrypt only for the specific IAM roles.. By modifying the KMS key policy to include a condition that allows kms:Decrypt only for the specific IAM roles (e.g., using the `aws:PrincipalArn` condition key), the security team ensures that only those roles can decrypt data encrypted with that key. Option A is incorrect because a KMS grant is a temporary permission that can be used to allow access to a KMS key without modifying the key policy, but it is not the best practice for persistent, role-based access and can be more complex to manage. Option C is incorrect because an IAM policy alone is insufficient; the key policy must also grant access to the IAM role. While an IAM policy can allow kms:Decrypt, it will only be effective if the key policy permits the role to use the key. The key policy is the primary access control mechanism for customer managed keys. Option D is incorrect because an S3 bucket policy controls access to S3 objects, not to the KMS key used for decryption. Even if an S3 bucket policy denies s3:GetObject, a user could still decrypt the data using the KMS key directly (e.g., via the KMS API) if they have permissions to do so.

Answer

Use a KMS grant to allow the roles to decrypt the key.

Answer

Attach an IAM policy to the roles that allows kms:Decrypt on the key.

Answer

Add an S3 bucket policy that denies s3:GetObject for all roles except the allowed ones.

Question 15

A company stores data in Amazon S3 and uses AWS KMS with Customer Master Keys (CMKs) for encryption. The security team wants to audit when the CMK is used to decrypt data. Which of the following will provide this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS Decrypt API calls, which is exactly what is needed to audit CMK decryption. Option A (AWS Config) records configuration changes, not API calls. Option B (Amazon CloudWatch Logs) can store logs but does not generate the KMS decrypt logs itself; CloudTrail generates them. Option D (S3 server access logs) record requests to S3 objects, not the KMS decryption calls that happen when accessing encrypted objects.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

S3 server access logs