SCS-C02 Data Protection Practice Test 18 — 15 Questions

Question 1

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.. AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.

Answer

Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.

Answer

Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.

Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.

Question 2

A healthcare company runs a HIPAA-compliant application on AWS. The application uses Amazon S3 to store Protected Health Information (PHI). The company has implemented the following controls: (1) All S3 buckets are configured with default encryption using SSE-S3. (2) Bucket policies restrict access to only authorized IAM roles. (3) S3 access logs are enabled and sent to a centralized logging account. (4) MFA Delete is enabled on all buckets. (5) Object lock is not enabled. Recently, an internal auditor discovered that when an authorized user deletes an object, the object is permanently deleted and cannot be recovered. The company's data retention policy requires that deleted PHI be recoverable for at least 30 days after deletion. A review of the IAM policies shows that users have s3:DeleteObject permission. The auditor also notes that the bucket versioning is not enabled. The security team needs to implement a solution that allows authorized users to delete objects but ensures that deleted objects can be recovered within 30 days. Which of the following is the MOST effective course of action?

Accepted Answer

Enable S3 Versioning on the buckets and ensure that the IAM policies include s3:DeleteObjectVersion where appropriate.. Enabling S3 Versioning is the most effective solution because it preserves all object versions, including deleted objects (which become delete markers). With versioning enabled, authorized users can still use s3:DeleteObject to delete the current version, but the previous versions remain recoverable. Since the requirement is to recover deleted PHI within 30 days, versioning combined with a lifecycle policy to permanently delete old versions after 30 days would meet the retention policy without blocking immediate deletion.

Answer

Enable S3 Object Lock in Governance mode with a retention period of 30 days.

Answer

Remove the s3:DeleteObject permission from all IAM policies and use S3 Lifecycle policies to expire objects after 30 days.

Answer

Change the default encryption from SSE-S3 to SSE-C and use a separate key for each object.

Question 3

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Configure the target group to use HTTPS protocol.. Configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Use a network load balancer instead of an ALB.

Answer

Assign a certificate from ACM to the ALB listener.

Question 4

A company uses S3 to store sensitive customer data. The security team requires that all objects uploaded to S3 be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). A developer reports that some objects are being stored unencrypted. What is the MOST effective way to enforce this requirement?

Accepted Answer

Use a bucket policy to deny s3:PutObject if encryption is not set to aws:kms. A bucket policy with a Deny effect on s3:PutObject when the condition `s3:x-amz-server-side-encryption` is not equal to `aws:kms` enforces SSE-KMS for all uploads. Option A is incorrect because default encryption using SSE-S3 can be overridden by the PUT request, and it does not enforce KMS. Option C is incorrect because SCPs apply at the account or organizational unit level, not to individual buckets, and are less direct than bucket policies. Option D is incorrect because requiring the `x-amz-server-side-encryption` header alone does not mandate the value `aws:kms`; a requester could set it to `AES256` (SSE-S3).

Answer

Enable default encryption on the bucket using SSE-S3

Answer

Use an SCP to deny s3:PutObject without encryption

Answer

Set a bucket policy to require the x-amz-server-side-encryption header

Question 5

A company uses Amazon S3 to store sensitive documents. They must ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which S3 bucket policy statement achieves this?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256 AND the encryption is SSE-S3.. Option C is correct because it explicitly denies PutObject unless the request includes both the x-amz-server-side-encryption header with value AES256 (which requests SSE-S3) and the encryption type is SSE-S3. This ensures only objects encrypted with SSE-S3 can be uploaded. Option A is incorrect because it only checks for the header value AES256; while AES256 is specific to SSE-S3 and would also enforce SSE-S3, Option C provides a more explicit condition. Option B is incorrect because it denies all PutObject requests. Option D is incorrect because an Allow statement cannot enforce a denial; a Deny statement is required to block unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256.

Answer

Deny s3:PutObject for all principals.

Answer

Allow s3:PutObject only when x-amz-server-side-encryption: AES256 is present.

Question 6

A company is designing a data protection strategy for sensitive customer data stored in Amazon S3. Which TWO actions should be taken to protect the data from accidental deletion?

Accepted Answer

Enable MFA Delete on the S3 bucket.. Options D and E are correct. MFA Delete adds an extra authentication factor for delete operations, providing protection against accidental or unauthorized deletion. S3 Versioning allows recovery of deleted or overwritten objects by preserving previous versions. Option A is incorrect because S3 Object Lock with retention mode prevents object deletion or overwrite for a fixed period, but it is not specifically designed to protect against accidental deletion; it is more for compliance. Option B is incorrect because cross-region replication replicates objects to another bucket, but it does not prevent deletion in the source bucket; it only creates copies. Option C is incorrect because a bucket policy that denies s3:DeleteObject for all principals would prevent all delete operations, which is overly restrictive and not a practical solution for protecting against accidental deletion while still allowing necessary administrative actions.

Answer

Use S3 Object Lock with retention mode.

Answer

Enable cross-region replication to another bucket.

Answer

Configure an S3 bucket policy that denies s3:DeleteObject for all principals.

Question 7

A security engineer applies the above S3 bucket policy. An application tries to upload an object with the header "x-amz-server-side-encryption: AES256". What will happen?

Accepted Answer

The upload fails because the encryption header does not match 'aws:kms'.. The first condition in the S3 bucket policy denies PutObject if the encryption header is not "aws:kms" (using StringNotEquals). Since the application sends "x-amz-server-side-encryption: AES256", which is not "aws:kms", the deny condition is triggered. The second condition denies if the header is missing, but here it is present, so it does not apply. Therefore, the upload is denied.

Answer

The upload succeeds because the policy allows SSE-S3.

Answer

The upload succeeds because the object is encrypted.

Answer

The upload fails because the header is missing.

Question 8

A security engineer needs to protect data in transit between an EC2 instance and an RDS database. The RDS database uses SSL/TLS certificates. What is the MOST secure way to ensure that the connection is encrypted?

Accepted Answer

Download the RDS CA certificate to the EC2 instance and configure the database client to use SSL and verify the certificate.. Downloading the RDS CA certificate to the EC2 instance and configuring the database client to use SSL with certificate verification ensures that the data in transit is encrypted and that the server's identity is verified, preventing man-in-the-middle attacks. Option A is incorrect because a self-signed certificate without proper verification does not provide a trusted chain of identity. Option B is incorrect because encryption at rest protects data stored on disk, not data in transit. Option D is incorrect because IAM policies can require SSL but cannot enforce the actual encryption of the connection; the client must still be configured to use SSL.

Answer

Configure the EC2 instance to use a self-signed certificate for SSL connections.

Answer

Enable encryption at rest on the RDS instance to automatically encrypt in-transit traffic.

Answer

Create an IAM policy that requires SSL connections to the RDS endpoint.

Question 9

Which TWO actions can help protect data at rest in Amazon EBS volumes? (Choose 2.)

Accepted Answer

Enable EBS encryption by default in the AWS Account settings.. Options D and E are correct. D: Enabling EBS encryption by default in AWS Account settings ensures that all new EBS volumes are encrypted at rest. E: Using encrypted EBS volumes with AWS KMS customer-managed keys provides granular control over encryption keys. Option A is incorrect because EBS snapshots are not automatically encrypted by default; they can be encrypted during copy or by enabling encryption by default for volumes. Option B is incorrect because encryption at rest is independent of instance type; any instance type can use encrypted EBS volumes. Option C is incorrect because configuring the OS to use encrypted file systems is not the primary method for protecting data at rest on EBS; EBS encryption at the volume level is more appropriate.

Answer

Enable automatic encryption of EBS snapshots by default.

Answer

Use an instance type that supports encryption at rest.

Answer

Configure the operating system to use encrypted file systems.

Question 10

Which THREE practices are recommended for managing encryption keys in AWS KMS? (Choose 3.)

Accepted Answer

Enable automatic rotation of the KMS key annually.. Options B, D, and E are correct. B: Enabling automatic key rotation annually is a best practice to ensure keys are rotated regularly without manual intervention. D: Using key policies to restrict which IAM roles can use the key follows the principle of least privilege. E: Enabling AWS CloudTrail logging to record KMS key usage provides an audit trail for security monitoring. Option A is incorrect because deleting a KMS key immediately can cause permanent data loss; instead, you should schedule key deletion. Option C is incorrect because exporting KMS key material and storing it in an S3 bucket would expose the key material and defeat the purpose of using a managed service like KMS.

Answer

Delete the KMS key immediately when it is no longer needed.

Answer

Export the KMS key material and store it in a secure S3 bucket.

Question 11

A company is migrating on-premises data to AWS using AWS Snowball Edge. The data must be encrypted in transit and at rest. Which combination of steps should be taken?

Accepted Answer

Use Snowball Edge with default encryption settings; data is encrypted at rest and in transit.. Snowball Edge automatically encrypts data at rest using AES-256 and uses TLS for data in transit. Option A is incorrect because client-side encryption is not required; Snowball Edge handles encryption automatically. Option B is incorrect because Snowball Edge transfers data via its own secure protocol, not VPN. Option C is incorrect because KMS is not directly used for Snowball encryption; the device manages its own encryption keys.

Answer

Encrypt the data with a client-side tool before copying to Snowball Edge.

Answer

Set up a VPN connection to AWS and transfer data over the VPN.

Answer

Use AWS KMS to generate a key and apply it to the Snowball Edge device.

Question 12

A security engineer examines the above output. The company requires automatic yearly key rotation. What should the engineer do?

Accepted Answer

Run 'aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab'. The key is a customer managed CMK (KeyRotationEnabled: false indicates it's not an AWS managed key, as AWS managed keys have rotation enabled automatically and cannot be disabled). Enabling automatic rotation on a customer managed CMK is done via the 'aws kms enable-key-rotation' CLI command. Option B is incorrect because AWS CloudHSM is not required for key rotation; automatic rotation can be enabled directly on the CMK without manual intervention. Option C is incorrect because replacing the key with an AWS managed key would remove control over rotation and is not a necessary action; the current key can have rotation enabled. Option D is incorrect because if key material is imported, automatic rotation is not supported; the key must be rotated manually.

Answer

Use AWS CloudHSM to generate a new key and rotate manually.

Answer

Replace the key with an AWS managed key.

Answer

Import a key material and enable automatic rotation.

Question 13

A company is designing a disaster recovery plan for encrypted Amazon EBS volumes. Which THREE steps are required to ensure that encrypted EBS snapshots can be restored in a different AWS Region?

Accepted Answer

Copy the encrypted snapshot to the target AWS Region. To restore encrypted EBS snapshots in a different AWS Region, you must copy the encrypted snapshot to the target region (B) and ensure the customer managed key (CMK) used for encryption is available in the target region (D). Re-encrypting the snapshot with a CMK in the target region (A) is optional if you want to use a different key, but it is not a required step. Options C and E are incorrect because AWS CloudHSM is not used for EBS encryption and sharing snapshots via AWS RAM does not guarantee key availability.

Answer

Re-encrypt the snapshot with a customer managed key (CMK) in the target region

Answer

Store the encryption key in AWS CloudHSM in the target region

Answer

Share the snapshot with the target region using AWS RAM

Question 14

A security engineer is designing a data protection strategy for an S3 bucket that contains sensitive documents. The bucket is accessed by multiple IAM users and roles. Which TWO actions will help protect the data at rest and in transit?

Accepted Answer

Add a bucket policy that denies requests without aws:SecureTransport. Enforcing HTTPS (aws:SecureTransport) protects data in transit by requiring all requests to use TLS. Option D is correct because enabling default encryption (SSE-S3 or SSE-KMS) ensures data at rest is automatically encrypted when written to S3. Option A is incorrect: S3 Access Logs are for auditing access, not for protecting data. Option C is incorrect: MFA Delete protects against accidental deletion, not data protection at rest or in transit. Option E is incorrect: pre-signed URLs provide time-limited access but do not inherently protect data at rest or enforce encryption in transit.

Answer

Enable S3 Access Logs and send them to a separate account

Answer

Enable MFA Delete on the S3 bucket

Answer

Use pre-signed URLs for all access

Question 15

A company stores sensitive data in an S3 bucket with default encryption (SSE-S3) enabled. A security audit reveals that objects are being accessed by users from unexpected IP addresses. The company wants to enforce that only objects encrypted with a specific KMS key (managed by the security team) can be accessed. Which combination of actions should be taken?

Accepted Answer

Modify the bucket policy to deny PutObject and GetObject unless the request includes the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header.. It uses a bucket policy with the 's3:x-amz-server-side-encryption-aws-kms-key-id' condition key to deny requests that do not include the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header. This enforces that only objects encrypted with the specified KMS key can be accessed. Option A is incorrect because SSE-C uses customer-provided keys and does not integrate with KMS key IDs; distributing a customer key does not enforce the specific KMS key. Option C is incorrect because S3 Block Public Access and AWS WAF do not control access based on encryption key. Option D is incorrect because lifecycle policies do not restrict access based on encryption key.

Answer

Use SSE-C and distribute the customer key to authorized users only.

Answer

Enable S3 Block Public Access and use AWS WAF to filter IP addresses.

Answer

Apply an S3 Lifecycle policy to transition objects to Glacier after 30 days.