SCS-C02 Data Protection Practice Test 18 — 15 Questions

Question 1

A company uses Amazon S3 to store confidential documents. The security team wants to ensure that all objects are encrypted at rest using server-side encryption with AES-256. Which S3 encryption option should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSE-S3. SSE-S3 applies server-side encryption with AES-256 using keys fully managed by Amazon S3, meeting the requirement for AES-256 encryption at rest without customer key management overhead. It is the default and simplest S3-managed encryption option, automatically encrypting every object with strong AES-256 and requiring no additional configuration or key infrastructure. This directly satisfies the stated requirement.

Answer

SSE-C

Answer

SSE-KMS

Answer

Client-side encryption

Question 2

A company is using Amazon S3 to store backup files that must be retained for 7 years. The files are accessed infrequently but must be available within minutes when needed. The company wants to minimize storage costs while ensuring data is encrypted at rest. Which storage class and encryption combination is most cost-effective?

Accepted Answer

S3 Glacier Instant Retrieval with SSE-S3. S3 Glacier Instant Retrieval provides millisecond retrieval (meeting the 'within minutes' requirement) at lower cost than S3 Standard-IA, and SSE-S3 provides encryption at rest at no additional cost. This combination minimizes storage costs while meeting access and encryption requirements.

Answer

S3 Glacier Deep Archive with SSE-S3

Answer

S3 Glacier Flexible Retrieval with SSE-KMS

Answer

S3 Standard-IA with SSE-KMS

Question 3

A company needs to encrypt data at rest in its Amazon EBS volumes. The company wants to use an encryption key that is automatically rotated every year without any manual intervention. Which key type should be used?

Accepted Answer

AWS managed key for EBS. AWS managed keys are automatically rotated annually. Option B (AWS managed key for EBS) is correct because this key type handles rotation automatically without any manual intervention. Option A (Imported key material in a customer managed key) is incorrect because imported key material does not support automatic rotation. Option C (Customer managed key with manual rotation) is incorrect because even though automatic rotation can be enabled on a customer managed key, the key type itself requires enabling rotation; the question implies a managed solution without manual setup. Option D (Default EBS encryption using an AWS managed key) is incorrect because it refers to an encryption setting, not a key type, and the question asks for the key type.

Answer

Imported key material in a customer managed key

Answer

Customer managed key with manual rotation

Answer

Default EBS encryption using an AWS managed key

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. The security team needs to audit all KMS key usage, including who used the key, when, and what operation was performed. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all AWS KMS API calls as events, including who made the request, the source IP address, the time of the request, and the specific operation performed (e.g., Encrypt, Decrypt, GenerateDataKey). These audit logs are stored in an S3 bucket and can be analyzed to meet the security team's requirement for full key usage auditing.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

AWS CloudHSM

Question 5

A company is designing a data protection strategy for its Amazon RDS for MySQL database. The database contains sensitive data that must be encrypted at rest. The company also needs to manage the encryption keys using its own HSM. Which solution should be used?

Accepted Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM. To encrypt an Amazon RDS for MySQL database at rest while managing keys in a customer-owned HSM, you must use AWS KMS with a custom key store backed by AWS CloudHSM. This allows you to use keys from your own CloudHSM cluster for RDS encryption. Option D is correct. Option A is incorrect because client-side encryption is not for at-rest encryption of the RDS instance itself. Option B is incorrect because you cannot directly import keys from CloudHSM into RDS; the integration is through KMS custom key store. Option C is incorrect because the default AWS KMS key does not allow you to manage the key in your own HSM.

Answer

Use client-side encryption with a key from CloudHSM

Answer

Use AWS CloudHSM to generate a key and import it into RDS

Answer

Enable encryption at rest using the default AWS KMS key

Question 6

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted in transit between the company's on-premises data center and AWS. Which solution should be used?

Accepted Answer

Use an AWS Site-to-Site VPN with IPsec to encrypt traffic. An AWS Site-to-Site VPN with IPsec is the correct solution because it creates an encrypted tunnel between the on-premises data center and AWS, ensuring all data in transit is protected. IPsec operates at the network layer (Layer 3) and encrypts the entire IP packet, providing confidentiality and integrity for data moving over the public internet. This directly addresses the requirement to encrypt data in transit between the two environments.

Answer

Use AWS CloudHSM to encrypt the data in transit

Answer

Enable SSE-S3 on the S3 bucket

Answer

Use AWS KMS to encrypt the data before transmission

Question 7

A company is designing a data protection strategy for its Amazon S3 bucket that stores sensitive customer data. The bucket must be encrypted at rest using a customer managed key (CMK) that is stored in AWS KMS. The company also needs to ensure that only authorized users can decrypt objects. Which TWO actions should the company take?

Accepted Answer

Modify the KMS key policy to allow only the authorized IAM roles to use the key. Option B is correct because the KMS key policy is the primary resource-based access control for a customer managed key, so modifying it to allow only the authorized IAM roles to use the key ensures that no other principals can call kms:Decrypt or otherwise use the CMK to access the encrypted S3 objects. Option C is correct because even if the key policy permits a role, the caller still needs an identity-based IAM policy granting kms:Decrypt on that specific CMK, so attaching such a policy to the authorized users is required for them to decrypt the objects. Together, the key policy and the IAM policy satisfy the requirement that only authorized users can decrypt data encrypted with the CMK. Option A does not belong because S3 server-side encryption with KMS does not use encryption context in the s3:GetObject request in the way described, and denying based on encryption context is not the mechanism for restricting decryption to authorized users. Option D does not belong because a VPC endpoint and bucket policy control network/API access to S3, not who can decrypt with the KMS CMK. Option E does not belong because SSE-C uses a customer-provided key rather than a CMK stored in AWS KMS, which contradicts the stated requirement.

Answer

Create a bucket policy that denies s3:GetObject unless the request includes a specific encryption context

Answer

Create a VPC endpoint for S3 and use bucket policies to restrict access to the endpoint

Answer

Use SSE-C with a customer-provided key

Question 8

A company uses AWS KMS to encrypt data in Amazon RDS. The security team wants to ensure that the KMS key can be used only by specific IAM roles and that all usage of the key is logged. Which TWO actions should the team take?

Accepted Answer

Enable AWS CloudTrail to log KMS API calls. To restrict KMS key usage to specific IAM roles, the key policy must be modified to grant only those roles the kms:Encrypt and kms:Decrypt permissions (option D). To log all usage of the key, enable AWS CloudTrail to capture KMS API calls (option C). Option A is incorrect because an S3 bucket policy does not control KMS key usage. Option B is incorrect because key rotation does not restrict access. Option E is incorrect because cross-account access is not specified as a requirement.

Answer

Apply an S3 bucket policy to the RDS automated backup bucket

Answer

Enable automatic key rotation

Answer

Create a cross-account key policy to allow all IAM roles in the account

Question 9

Refer to the exhibit. A security engineer is reviewing the bucket encryption configuration. The bucket is used to store sensitive data. The company policy requires that all objects be encrypted using AWS KMS with a customer managed key. What should the engineer do to meet the policy?

Accepted Answer

Update the bucket encryption configuration to use SSEAlgorithm: aws:kms and specify a KMS key ID. The company policy requires AWS KMS with a customer managed key, which corresponds to SSE-KMS with SSEAlgorithm set to aws:kms and an explicit KMS key ID (or ARN) in the bucket's default encryption configuration. Updating the bucket encryption configuration via PutBucketEncryption with the KMS key ARN satisfies the requirement for all newly uploaded objects.

Answer

Enable the bucket key and set SSEAlgorithm to AES256

Answer

Use client-side encryption with a KMS key

Answer

Add a bucket policy that requires kms:Encrypt permission for all PutObject requests

Question 10

Refer to the exhibit. A security engineer is reviewing the CloudWatch Logs configuration for a Lambda function. The log group is encrypted with a customer managed key. The engineer needs to ensure that only the Lambda service can write logs to this log group and that only a specific IAM role can read logs. Which additional configuration is required?

Accepted Answer

Add a condition to the KMS key policy that uses kms:ViaService to restrict encryption/decryption to logs.amazonaws.com and a condition that the Lambda function is the source. To ensure only the Lambda service can write logs and only a specific IAM role can read logs, you need to use KMS key policy conditions. The key policy should include a condition that allows CloudWatch Logs to use the key for encryption/decryption only when the request originates from the Lambda service (using kms:ViaService condition). Additionally, you can restrict read access by specifying the IAM role in the key policy. Option A is incorrect because resource-based policies on log groups cannot restrict write access to Lambda only; they are typically used for cross-account access. Option B is incorrect because S3 bucket policies are not applicable to CloudWatch Logs. Option C is incorrect because you cannot assign an IAM role to a log group; IAM roles are assumed by entities, not assigned to resources.

Answer

Attach a resource-based policy to the log group that allows only the Lambda service to write logs

Answer

Create an S3 bucket policy to allow only Lambda to write to the log group

Answer

Assign an IAM role to the log group that has permission to write logs

Question 11

A company stores sensitive customer data in Amazon S3. To comply with data protection regulations, they need to automatically prevent any new objects from being made publicly accessible. Which S3 feature should they configure?

Accepted Answer

Enable S3 Block Public Access at the account level.. S3 Block Public Access at the account level applies a blanket deny on any policy or ACL that would make an object or bucket public, and it overrides bucket policies and ACLs. Enabling it at the account level ensures all current and future buckets in the account are protected from accidental public exposure. This is the AWS-recommended preventive control for data protection compliance.

Answer

Configure a bucket policy that denies s3:PutObject with a condition for public access.

Answer

Use S3 default encryption with SSE-S3.

Answer

Enable S3 Object Lock in governance mode.

Question 12

A company needs to protect data at rest on Amazon EBS volumes attached to EC2 instances. Which solution provides the most control over the encryption keys?

Accepted Answer

Use a customer managed KMS key with EBS encryption.. A customer managed KMS key gives the account owner full control over the key policy, rotation, grants, and deletion, which is the maximum control available for EBS encryption at rest. AWS managed keys (aws/ebs) are controlled by AWS and cannot be customized or have their policies modified by the customer. Enabling EBS encryption by default only sets a default key but does not by itself provide the most control. Client-side encryption is a different layer and does not address EBS-native encryption key control.

Answer

Encrypt data using client-side encryption before writing to EBS.

Answer

Use an AWS managed KMS key for EBS encryption.

Answer

Enable EBS encryption by default in the account.

Question 13

A company uses Amazon RDS for MySQL with encryption at rest enabled using AWS KMS. They need to ensure that automated backups and snapshots are also encrypted. Which configuration is required?

Accepted Answer

No additional configuration is needed; backups are encrypted automatically.. Amazon RDS automatically encrypts automated backups and snapshots when the source database is encrypted at rest. This encryption is inherited from the primary database, so no additional steps are required. Options B, C, and D are incorrect: manually encrypting each snapshot is unnecessary; assigning a new KMS key to backups is not required; and enabling encryption after creation is not possible for an existing unencrypted instance.

Answer

Manually encrypt each snapshot with a separate KMS key.

Answer

Create a new KMS key and assign it to the backup configuration.

Answer

Enable encryption on the RDS instance after creation.

Question 14

A company uses AWS Secrets Manager to rotate database credentials automatically. The security team wants to ensure that while the secret is being rotated, applications can always retrieve a valid credential. Which rotation strategy should be used?

Accepted Answer

Use the alternating users rotation strategy.. The alternating users rotation strategy (Option D) is correct because it creates two sets of credentials—one active and one pending—so that during rotation, at least one set remains valid for applications. Option A (IAM database authentication) is not a rotation strategy for Secrets Manager. Option B (single user rotation with immediate update) would cause a brief period where the credential is invalid, leading to potential downtime. Option C (disabling automatic rotation) defeats the purpose of automated rotation.

Answer

Use AWS IAM database authentication instead.

Answer

Use a single user rotation with immediate update.

Answer

Disable automatic rotation and manually update credentials.

Question 15

A company needs to share an encrypted Amazon S3 object with another AWS account. The object is encrypted with an AWS KMS customer managed key. Which steps are required?

Accepted Answer

Update both the bucket policy and the KMS key policy to grant cross-account access.. Cross-account access to a KMS-encrypted S3 object requires permissions on both sides: the S3 bucket policy must grant the external account s3:GetObject, and the KMS key policy must grant that account kms:Decrypt. Without the KMS key policy update, the external account's request fails with AccessDenied even if the bucket policy allows it, because S3 delegates decryption authorization to KMS.

Answer

Use an object ACL to grant the other account read access.

Answer

Update the bucket policy to allow the other account to access the object.

Answer

Update the KMS key policy to allow the other account to decrypt.