SCS-C02 Data Protection Practice Test 17 — 15 Questions

Question 1

A company stores sensitive data in an Amazon S3 bucket. The security team requires that all data in transit between the company's on-premises data center and S3 be encrypted. Which solution meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use HTTPS (TLS) endpoints when uploading objects to S3.. Using HTTPS (TLS) ensures encryption of data in transit between the client and S3. Option A is incorrect because although an IPsec VPN encrypts traffic between the data center and AWS, the data is then decrypted and sent to S3, so it does not guarantee encryption for the entire path unless S3 is accessed via HTTPS as well. Option B is incorrect because S3 Transfer Acceleration speeds up transfers using edge locations but does not provide encryption; HTTPS is still required. Option D is incorrect because a VPC endpoint for S3 provides private connectivity but does not encrypt traffic; encryption still relies on HTTPS.

Answer

Set up an IPsec VPN connection between the data center and AWS, and access S3 through the VPN.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use AWS PrivateLink to create a VPC endpoint for S3.

Question 2

A company is migrating sensitive data to Amazon S3. The data must be encrypted at rest using keys managed by the company. The company also requires an audit trail of key usage. Which solution meets these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed key and enable CloudTrail for KMS.. SSE-KMS with a customer-managed key and CloudTrail for KMS. This solution meets both requirements: the company manages its own keys (customer-managed CMK) and CloudTrail logs every KMS API call, providing an audit trail of key usage. Option A (SSE-S3) uses Amazon-managed keys, so no customer control or audit trail. Option B (SSE-C) requires the customer to manage keys themselves but does not integrate with CloudTrail for key usage auditing; also, storing keys in Secrets Manager does not provide an audit trail of KMS key usage. Option D (CloudHSM) can be used, but it requires more complex setup for auditing; SSE-KMS with CloudTrail is the simpler and more direct solution.

Answer

Use SSE-S3 with default encryption.

Answer

Use SSE-C and store the keys in AWS Secrets Manager.

Answer

Use AWS CloudHSM to generate and store keys, and use Amazon S3 with SSE-KMS.

Question 3

A company is designing a data protection strategy for Amazon EFS file systems. The security team requires encryption at rest and in transit. Additionally, the team needs to control which KMS keys can be used to encrypt the file system. Which THREE steps should the team take?

Accepted Answer

Configure a KMS key policy that allows the EFS service to use the key.. Option A is correct because the KMS key policy must explicitly grant the EFS service principal (elasticfilesystem.amazonaws.com) permission to use the customer-managed key for cryptographic operations; without this, EFS cannot use the key to encrypt or decrypt file data. Option B is correct because encryption at rest on EFS is enabled at file-system creation time by specifying a customer-managed KMS key, which is exactly how the team controls which key protects the file system. Option E is correct because EFS encryption in transit is achieved by mounting with the TLS option via the EFS mount helper (for example, using -o tls with amazon-efs-utils), which enforces TLS 1.2 for NFS traffic. Option C is wrong because EFS does not support SSE-S3; that is an Amazon S3 server-side encryption option, and EFS uses KMS keys instead. Option D is wrong because an IAM policy restricting who can create encrypted file systems does not itself enable encryption at rest or in transit, nor does it control which KMS keys are used for a given file system.

Answer

Enable default encryption on the EFS file system using SSE-S3.

Answer

Use an IAM policy to restrict which users can create encrypted file systems.

Question 4

A company wants to protect data stored in Amazon S3 Glacier. The data must be encrypted at rest and the encryption keys must be rotated annually. Which TWO options meet these requirements?

Accepted Answer

Use SSE-KMS with a customer-managed key that has automatic key rotation enabled.. SSE-KMS with a customer-managed key that has automatic key rotation enabled allows annual rotation and meets the encryption requirement. Option E is correct because S3 Glacier's default encryption, SSE-S3, encrypts data at rest and AWS manages key rotation automatically on an annual basis. Option B is incorrect because AWS CloudHSM requires manual key rotation. Option C is incorrect because client-side encryption with the Amazon S3 encryption client does not use server-side encryption and requires manual key management. Option D is incorrect because SSE-C requires you to manage and rotate the keys manually.

Answer

Use AWS CloudHSM to generate a key and encrypt data before uploading to Glacier.

Answer

Use client-side encryption with the Amazon S3 encryption client.

Answer

Use SSE-C with keys stored in AWS Secrets Manager and rotate keys annually.

Question 5

Refer to the exhibit. A user named John encrypts a file using the AWS CLI. John then tries to decrypt the file but receives an AccessDenied error. John has full administrator permissions in IAM. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant John the kms:Decrypt permission.. The most likely cause is that the KMS key policy does not grant John the kms:Decrypt permission. Even though John has full administrator permissions in IAM, KMS key policies are resource-based policies that must explicitly allow the principal to use the key. If the key policy does not grant John decrypt permissions, access is denied.

Answer

The ciphertext blob is malformed because it was not base64-decoded before decryption.

Answer

John's IAM policy denies the kms:Decrypt action.

Answer

The key ID used for encryption is different from the key used for decryption.

Question 6

Refer to the exhibit. A security engineer reviews the bucket policy for an S3 bucket. The engineer attempts to upload an object to the bucket using the AWS CLI without the --ssl flag (HTTP). What is the outcome?

Accepted Answer

The upload fails because the policy denies requests that are not using HTTPS.. The bucket policy includes a condition that explicitly denies all s3: actions (including s3:PutObject) when the request does not use HTTPS (SecureTransport is false). Since the engineer uses HTTP (no --ssl flag), the condition is met, and the upload is denied. Option A is incorrect because the policy does not allow all actions; it includes a conditional deny. Option C is incorrect because default encryption does not override the explicit deny in the policy. Option D is incorrect because the policy denies all s3 actions, not just s3:PutObject.

Answer

The upload succeeds because the policy allows all actions.

Answer

The upload succeeds because the bucket has default encryption enabled.

Answer

The upload fails because the policy denies s3:PutObject only.

Question 7

A security engineer needs to ensure that all data in transit between an Application Load Balancer and EC2 instances is encrypted using TLS. Which configuration is required?

Accepted Answer

Configure the ALB with an HTTPS listener and the target group with HTTPS protocol.. To encrypt data in transit between the Application Load Balancer and EC2 instances, the ALB must have an HTTPS listener and the target group must use HTTPS protocol. This ensures end-to-end TLS encryption from client to ALB and from ALB to EC2 instances. Option A correctly specifies this configuration.

Answer

Configure the ALB with an HTTPS listener and the target group with HTTP protocol.

Answer

Configure the ALB with a TLS listener and the target group with TCP protocol.

Answer

Configure the ALB with a TCP listener and the target group with HTTP protocol.

Question 8

A company uses AWS KMS to encrypt data in Amazon S3. They need to audit all KMS key usage for an S3 bucket. Which AWS service should be used to capture KMS Decrypt API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail captures API calls to AWS services, including KMS Decrypt. CloudTrail logs can be delivered to S3 for analysis. Option C is correct. CloudWatch Logs can receive logs but does not directly capture KMS API calls; S3 server access logs do not include KMS decryption events; VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon S3 server access logs

Answer

Amazon VPC Flow Logs

Answer

AWS CloudWatch Logs

Question 9

A company stores sensitive data in Amazon S3 and requires that objects are automatically encrypted using server-side encryption with AWS KMS. The bucket policy must deny any PUT request that does not include the x-amz-server-side-encryption header with value aws:kms. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The condition key s3:x-amz-server-side-encryption can be used to check the header value. Condition key aws:SourceIp is for source IP; aws:RequestedRegion is for region; kms:EncryptionContext is for KMS encryption context. Option A is correct.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

kms:EncryptionContext

Question 10

A company uses AWS KMS to encrypt data in Amazon RDS. The security team needs to ensure that the KMS key cannot be deleted accidentally. Which action should be taken?

Accepted Answer

Add a statement to the key policy that denies the kms:ScheduleKeyDeletion action.. A key policy statement that explicitly denies kms:ScheduleKeyDeletion prevents any principal from scheduling the key for deletion, which is the strongest guard against accidental deletion. Explicit deny in a key policy overrides any allow, so even administrators cannot schedule deletion.

Answer

Create an alias for the key.

Answer

Enable automatic key rotation.

Answer

Use a multi-Region key.

Question 11

A company has an S3 bucket with versioning enabled. They want to ensure that all deleted objects are retained for 90 days before permanent deletion. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle policy with NoncurrentVersionExpiration. S3 Lifecycle policies can manage the expiration of noncurrent versions of objects. In this scenario, after an object is deleted, it becomes a noncurrent version. A lifecycle rule with NoncurrentVersionExpiration can be set to permanently delete those noncurrent versions after a specified number of days (e.g., 90). Option A is correct. S3 Object Lock protects objects from deletion but does not automatically delete them after a period. S3 Replication is for copying objects to another bucket. MFA Delete adds a multi-factor authentication requirement for deletion but does not set a retention period.

Answer

S3 Replication

Answer

S3 Object Lock

Answer

MFA Delete

Question 12

A company needs to encrypt data at rest in Amazon EBS volumes. They want to use an AWS managed key that is automatically rotated. Which encryption option should they choose?

Accepted Answer

Enable EBS encryption by default using the AWS managed key for Amazon EBS.. Enabling EBS encryption by default using the AWS managed key for Amazon EBS (alias `aws/ebs`) ensures data at rest is encrypted with a key that is automatically rotated on an annual basis, as required. This key is managed by AWS and requires no manual intervention for rotation, meeting the company's need for a managed, automatically rotated key.

Answer

Use SSE-S3.

Answer

Use a customer-managed KMS key with automatic rotation enabled.

Answer

Use client-side encryption.

Question 13

Refer to the exhibit. A security engineer runs the AWS CLI command shown and receives an AccessDenied error. The IAM user Alice has a policy that grants kms:Decrypt on all resources. What is the most likely cause of the error?

Accepted Answer

The KMS key policy does not grant kms:Decrypt to the IAM user Alice.. AWS KMS enforces a two-part authorization model: the caller must be allowed by both the identity-based IAM policy and the KMS key policy. Even though Alice's IAM policy grants kms:Decrypt on all resources, the key policy must also grant her (or her account with delegation) access to that key. If the key policy does not permit Alice, the request is denied, which is the most likely cause of the AccessDenied error.

Answer

The IAM user policy does not allow kms:Decrypt.

Answer

The command uses the wrong key ID.

Answer

The ciphertext blob is corrupted.

Question 14

Refer to the exhibit. A security engineer runs the command shown and gets the output. What does this output indicate about the bucket's encryption configuration?

Accepted Answer

The bucket has default encryption enabled using SSE-S3.. The output shows that default encryption is set to AES256, which corresponds to SSE-S3. This means new objects uploaded to the bucket will be encrypted with SSE-S3 unless a different encryption header is provided. Therefore, option D is correct. Option A is incorrect because the default encryption setting does not prevent unencrypted objects from being uploaded if the client does not provide encryption headers—it only applies encryption by default. Option B is incorrect because SSE-KMS uses a different key management service, not AES256. Option C is incorrect because default encryption does not require all objects to be encrypted with SSE-KMS; it sets a server-side default, but clients can override with their own encryption settings.

Answer

The bucket does not allow unencrypted objects.

Answer

The bucket has default encryption enabled using SSE-KMS.

Answer

The bucket requires all objects to be encrypted with SSE-KMS.

Question 15

A financial services company is designing a data protection strategy for its DynamoDB table containing sensitive customer data. The table has a global secondary index (GSI). The company needs to encrypt the data at rest using a customer managed key (CMK) that is rotated annually. Which solution meets these requirements?

Accepted Answer

Create the table with a customer managed key (CMK) and enable automatic key rotation. DynamoDB supports encryption at rest using AWS KMS. When a table is created, you must specify whether to use a default AWS managed key or a customer managed key (CMK). The global secondary index (GSI) inherits the encryption settings from the base table and cannot have separate encryption settings. Option D is correct because you can create the table with a CMK and enable automatic key rotation on that CMK. Option A is incorrect because you cannot change the encryption key of an existing DynamoDB table; encryption settings must be specified at creation. Option B is incorrect because DynamoDB tables always have encryption enabled by default (you cannot create a table without encryption), and you cannot enable encryption separately on the GSI. Option C is incorrect because the requirement specifies a customer managed key (CMK), not an AWS managed key; while AWS managed keys have automatic rotation by default, they do not provide customer control over the key.

Answer

Create the table with default encryption, then update the table to use a CMK and enable automatic rotation

Answer

Create the table without encryption, then enable encryption on the table and GSI separately using a CMK

Answer

Create the table with an AWS managed key and use AWS KMS automatic rotation