SCS-C02 Data Protection Practice Test 19 — 15 Questions

Question 1

A company is designing a data protection solution for Amazon S3 that must prevent any user from accidentally deleting objects. Which combination of S3 features should be used?

Accepted Answer

Enable S3 Versioning and MFA Delete.. Enabling S3 Versioning preserves all object versions, allowing recovery of deleted objects, and MFA Delete requires multi-factor authentication for permanent deletions, preventing accidental or unauthorized deletions. Option A is wrong because Cross-Region Replication copies objects to another bucket but does not prevent deletion of the source objects. Option B is wrong because Object Lock with governance mode prevents overwrites and deletions only if a retention period is set, but it does not block deletion of the bucket itself or version-level deletions if the lock is not applied. Option C is wrong because default encryption (SSE-KMS) protects data at rest but does not prevent deletion of objects.

Answer

Use S3 Cross-Region Replication to another bucket.

Answer

Enable S3 Object Lock with governance mode.

Answer

Configure S3 default encryption with SSE-KMS.

Question 2

A company is migrating on-premises databases to Amazon RDS for MySQL. The security team requires that data be encrypted at rest and in transit. Which combination of steps should the team take to meet these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance and set the rds.force_ssl parameter to 1 in the DB parameter group.. Enabling encryption at rest on the RDS instance (which can be done during creation or via a snapshot copy with encryption enabled) and requiring SSL for connections (by setting the rds.force_ssl parameter to 1 in the DB parameter group) ensures data is encrypted both at rest and in transit. Option A is incorrect because an RDS proxy with TLS termination does not enforce encryption for direct connections to the database, and encryption at rest alone does not cover in-transit. Option C is incorrect because using a client-side encryption library is not a standard RDS feature and would require application changes; it does not provide at-rest encryption managed by RDS. Option D is incorrect because configuring the security group to allow only HTTPS traffic is for HTTP-based services, not for MySQL connections; MySQL uses a different protocol, and HTTPS does not apply to database connections.

Answer

Use an RDS proxy with TLS termination and enable encryption at rest.

Answer

Enable encryption at rest on the RDS instance and use a client-side encryption library.

Answer

Enable encryption at rest and configure the security group to allow only HTTPS traffic.

Question 3

A company uses AWS KMS to encrypt secrets stored in AWS Secrets Manager. The security team wants to audit all KMS key usage, including attempts to use the key without proper authorization. Which AWS service should the team use to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records every API call made to KMS, including successful and failed attempts to use, encrypt, decrypt, or manage keys. Failed attempts due to insufficient permissions are logged as AccessDenied errors, giving the security team the audit trail they need. CloudTrail is the authoritative service for API-level auditing across AWS.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 4

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with Amazon S3-managed keys (SSE-S3). What is the minimum permission required for an IAM user to upload an object that will be encrypted with SSE-S3?

Accepted Answer

s3:PutObject. For SSE-S3, Amazon S3 manages the encryption keys entirely, so the IAM user does not need any AWS KMS permissions. The only permission required to upload an object with SSE-S3 is s3:PutObject, which allows the upload operation. S3 automatically encrypts the object with an S3-managed key when the request specifies SSE-S3 or when default encryption is enabled.

Answer

s3:PutObjectAcl

Answer

kms:Decrypt

Answer

kms:GenerateDataKey

Question 5

A company stores data in Amazon S3 and uses AWS KMS with Customer Master Keys (CMKs) for encryption. The security team wants to audit when the CMK is used to decrypt data. Which of the following will provide this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS Decrypt API calls, which is exactly what is needed to audit CMK decryption. Option A (AWS Config) records configuration changes, not API calls. Option B (Amazon CloudWatch Logs) can store logs but does not generate the KMS decrypt logs itself; CloudTrail generates them. Option D (S3 server access logs) record requests to S3 objects, not the KMS decryption calls that happen when accessing encrypted objects.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

S3 server access logs

Question 6

A company wants to protect sensitive data stored in Amazon S3. Which TWO actions should the company take to meet this goal? (Choose TWO.)

Accepted Answer

Enable S3 Block Public Access.. Option C (Enable S3 Block Public Access) is correct because it applies account- and bucket-level settings that reject any ACL or bucket policy granting public access, preventing accidental exposure of sensitive objects to the internet. Option E (Enable default encryption on the bucket) is correct because it ensures every object is encrypted at rest with SSE-S3 or SSE-KMS automatically, protecting data confidentiality even if storage media is compromised. Option A (S3 Transfer Acceleration) only speeds up uploads/downloads via edge locations and does not protect data. Option B (S3 event notifications to Amazon SNS) merely reports object events and provides no security control. Option D (S3 Object Lock) enforces WORM retention to prevent deletion or modification, which addresses integrity/retention rather than protecting sensitive data from unauthorized access or disclosure.

Answer

Enable S3 Transfer Acceleration.

Answer

Configure S3 event notifications to send events to Amazon SNS.

Answer

Enable S3 Object Lock.

Question 7

A company is designing a data protection solution for Amazon S3 that must prevent any user from accidentally deleting objects. Which combination of S3 features should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable default encryption on the bucket with SSE-S3 or SSE-KMS.. Option A is correct because enabling default encryption on the bucket with SSE-S3 or SSE-KMS ensures that every object stored in the bucket is automatically encrypted at rest, satisfying the compliance requirement for encryption of all objects. Option B is correct because a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header actively blocks any attempt to upload an object without server-side encryption, enforcing encryption at upload time. Together, these two steps provide both automatic encryption and a preventive control against unencrypted uploads. Option C is not correct because S3 Object Lock provides WORM protection and retention, not encryption enforcement. Option D is not correct because S3 Transfer Acceleration only improves upload performance over long distances. Option E is not correct because S3 Block Public Access prevents public exposure of objects, not unencrypted uploads.

Answer

Enable S3 Object Lock.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable S3 Block Public Access.

Question 8

Refer to the exhibit. An administrator applies this bucket policy to an S3 bucket. Which of the following statements describes the effect of this policy?

Accepted Answer

The policy denies all PutObject requests that do not specify SSE-KMS.. The bucket policy contains two Deny statements: the first denies PutObject when the `x-amz-server-side-encryption` header is not `aws:kms`, and the second denies PutObject when the header is absent (null). Together, they ensure that any upload without SSE-KMS is denied, effectively requiring SSE-KMS for all PutObject requests. Options B, C, and D are incorrect because the policy does not allow any unencrypted uploads or uploads with SSE-S3; it only allows uploads with SSE-KMS.

Answer

The policy allows uploads without encryption but denies uploads with SSE-KMS.

Answer

The policy allows unencrypted uploads but denies uploads with SSE-KMS.

Answer

The policy allows uploads with SSE-S3 but denies uploads with SSE-KMS.

Question 9

Refer to the exhibit. A security engineer configures the above KMS key policy. The DataAccess role is used by an application that runs on EC2 instances in the us-east-1 region. The application needs to read encrypted objects from an S3 bucket in the same region. Which of the following is true about this configuration?

Accepted Answer

The role can decrypt objects in S3, but cannot use the key outside of S3.. The key policy includes a condition 'kms:ViaService' that restricts use of the key to requests that originate from S3 in us-east-1. The DataAccess role has permissions to call kms:Decrypt and kms:GenerateDataKey. With kms:Decrypt, the role can decrypt objects in S3 (e.g., via S3 GetObject with SSE-KMS). The role can also encrypt objects via S3 PutObject using kms:GenerateDataKey. However, the 'kms:ViaService' condition prevents the role from using the key for any operation outside of S3 (e.g., direct KMS API calls). Option A is incorrect because the condition restricts usage to S3 in us-east-1 only, not any region or any operation. Option B is incorrect because the condition 'kms:ViaService' is syntactically valid and functions as intended. Option C is incorrect because the role has kms:GenerateDataKey, which allows encryption via S3 PutObject, and kms:Decrypt for decryption, so it can both encrypt and decrypt.

Answer

The role can use the key for any S3 operation in any region.

Answer

The role cannot use the key for any operation because the condition is invalid.

Answer

The role can only encrypt data, not decrypt it.

Question 10

Refer to the exhibit. A security engineer runs the above AWS CLI command to encrypt a secret file. The command succeeds and returns a base64-encoded ciphertext. Which of the following statements is correct?

Accepted Answer

The command returns a base64-encoded ciphertext that can be decrypted with the same KMS key.. The command encrypts the plaintext file using the specified KMS key and returns the ciphertext as base64-encoded output. Option A is wrong because the command does not specify an encryption context; it's optional. Option B is wrong because the command uses fileb:// which reads binary data; it will succeed if the file exists. Option D is wrong because the output is the ciphertext, not a data key.

Answer

The command returns a plaintext data key and an encrypted copy.

Answer

The command will fail because fileb:// is not a valid prefix.

Answer

The command will fail because encryption context is required.

Question 11

A company wants to protect sensitive data stored in Amazon S3 by encrypting it at rest. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (AWS KMS). AWS Key Management Service (AWS KMS) is the AWS service designed to create, manage, rotate, and audit encryption keys used to protect data at rest in AWS services including Amazon S3. S3 server-side encryption with AWS KMS keys (SSE-KMS) integrates directly with KMS, giving the company centralized key management, granular IAM policies, key rotation, and CloudTrail audit logs of key usage. This is the correct answer for managing encryption keys for S3 data at rest.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS S3-managed keys (SSE-S3)

Question 12

A company needs to ensure that data in transit between an EC2 instance and an RDS database is encrypted. Which solution meets this requirement?

Accepted Answer

Enable SSL/TLS on the database connection. SSL/TLS is the appropriate solution to encrypt data in transit between the EC2 instance and the RDS database. It ensures that data is encrypted during transmission, preventing eavesdropping or tampering. Option A is incorrect because a VPN connection encrypts traffic between networks but is unnecessary for direct connectivity within the same VPC; SSL/TLS is more straightforward. Option B is incorrect because encryption at rest protects data stored on disk, not data in motion. Option D is incorrect because client-side encryption would require modifying the application to encrypt data before sending, which does not guarantee encryption of the entire communication channel.

Answer

Use a VPN connection between the VPC and the database

Answer

Enable encryption at rest on the RDS instance

Answer

Use client-side encryption on the application

Question 13

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt the data. What is the MOST secure way to enforce this?

Accepted Answer

Configure the KMS key policy with a condition that allows only the role to decrypt. AWS KMS key policies are the primary resource-based access control for a KMS key. To ensure only a specific IAM role can decrypt, the key policy must explicitly allow that role (and no other principals) for kms:Decrypt, optionally with conditions. IAM policies alone cannot grant access to a KMS key unless the key policy also permits it, making the key policy the authoritative enforcement point.

Answer

Attach an IAM policy to the role granting kms:Decrypt

Answer

Disable the KMS key and re-enable it only when the role needs to decrypt

Answer

Configure an S3 bucket policy that denies all principals except the role

Question 14

A company wants to protect sensitive data stored in Amazon S3 by enforcing encryption in transit. Which policy should be used to deny requests that do not use HTTPS?

Accepted Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*", "Condition": {"Bool": {"aws:SecureTransport": "false"}}}. It uses the aws:SecureTransport condition set to 'false' to deny requests that are not using HTTPS. Option A is incorrect because it denies requests when SecureTransport is 'true', meaning it would block legitimate HTTPS traffic. Option C is incorrect because it checks for the presence of the s3:x-amz-server-side-encryption header, which relates to encryption at rest, not encryption in transit. Option D is incorrect because it denies all requests unconditionally, which would block all traffic, including HTTPS.

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*", "Condition": {"Bool": {"aws:SecureTransport": "true"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*", "Condition": {"Null": {"s3:x-amz-server-side-encryption": "true"}}}

Answer

{"Effect": "Deny", "Principal": "*", "Action": "s3:*", "Resource": "*"}

Question 15

A company wants to ensure that data stored in Amazon EBS volumes is encrypted at rest. What is the easiest way to achieve this?

Accepted Answer

Enable EBS encryption by default in the AWS Region. Enabling EBS encryption by default in the AWS Region automatically encrypts all new EBS volumes and snapshots with no additional effort. Option A is incorrect: KMS key rotation does not enable encryption; it rotates the key used for encryption. Option B is incorrect: while you can encrypt individual volumes after creation, the easiest method is to enable default encryption. Option D is incorrect: application-level encryption is not needed for EBS volumes and is more complex to implement.

Answer

Use AWS KMS to rotate the EBS encryption key

Answer

Use a script to encrypt each volume after creation

Answer

Use application-level encryption