SCS-C02 Data Protection Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. A user receives the above error when trying to decrypt a file using AWS KMS. The key policy is shown below:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AdminRole"
      },
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the likely cause of the error?

Accepted Answer

The IAM user 'john' is not granted kms:Decrypt in the key policy. The error occurs because the key policy only grants the kms:Decrypt action to the AdminRole (arn:aws:iam::123456789012:role/AdminRole). The IAM user 'john' is not a principal in the key policy and does not have the necessary permissions to decrypt the ciphertext. Option A is wrong because the ciphertext being encrypted with a different key would typically result in an 'InvalidCiphertextException', not a permission error. Option B is wrong because if the KMS key did not exist, the error would be 'NotFoundException'. Option C is wrong because an incorrect command syntax would produce a CLI parsing error, not a KMS permission error. Option D correctly identifies that the IAM user 'john' is not granted kms:Decrypt in the key policy.

Answer

The ciphertext was encrypted with a different KMS key

Answer

The KMS key does not exist

Answer

The command syntax is incorrect

Question 2

A company runs a critical application on Amazon EC2 instances that store sensitive data on EBS volumes. The security team has enabled EBS encryption by default for the region. However, after a recent security audit, it was discovered that some EBS volumes are not encrypted. The team finds that these volumes were created before the default encryption setting was enabled. The company's security policy mandates that all EBS volumes must be encrypted at rest, and the process must minimize downtime. The application cannot tolerate more than 5 minutes of downtime. The EC2 instances are running production workloads. What should the security engineer do to remediate the unencrypted volumes?

Accepted Answer

Create a new encrypted EBS volume, detach the unencrypted volume, and attach the new encrypted volume to the instance. Then copy data from a backup.. It allows creating a new encrypted volume and attaching it to the instance without significant downtime (a few minutes for detachment/attachment). Option A is wrong because enabling encryption on an existing volume is not supported. Option C is wrong because stopping the instance and creating an encrypted snapshot/volume would cause more downtime (stop/start). Option D is wrong because migrating to a new instance would require additional setup and likely more downtime.

Answer

Enable encryption on the existing EBS volumes directly from the console

Answer

Stop the instance, create an encrypted snapshot of the unencrypted volume, restore a new encrypted volume from the snapshot, and start the instance

Answer

Launch a new EC2 instance with an encrypted EBS volume, migrate the application to the new instance, and terminate the old instance

Question 3

A company stores sensitive customer data in Amazon S3. They want to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which S3 bucket policy statement should be added to deny uploads that do not request SSE-KMS?

Accepted Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'aws:kms'. The condition 's3:x-amz-server-side-encryption' with value 'aws:kms' enforces that objects are uploaded with SSE-KMS. Option A is incorrect because 'AES256' enforces SSE-S3, not SSE-KMS. Option C is incorrect because 'aws:SourceArn' is used for cross-account access, not encryption enforcement. Option D is incorrect because requiring the specific KMS key ID is too restrictive; the policy should only require the encryption type, not a particular key.

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'AES256'

Answer

Deny PutObject unless 'aws:SourceArn' equals the bucket ARN

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption-aws-kms-key-id' is present

Question 4

A financial company uses AWS KMS to encrypt sensitive data. The security team notices that a KMS key has been deleted, but the encrypted data is still needed for a short period. What is the fastest way to make the data decryptable again?

Accepted Answer

Cancel the key deletion within the waiting period. When a KMS key is scheduled for deletion, there is a waiting period (7-30 days) during which the deletion can be cancelled, restoring the key and making the data decryptable. Option A is incorrect because AWS Support cannot recover a deleted KMS key. Option C is incorrect because CloudHSM backups are unrelated to KMS key material. Option D is incorrect because re-encrypting with a new key would require the original key to decrypt first.

Answer

Contact AWS Support to recover the key material

Answer

Restore the key from a CloudHSM backup

Answer

Re-encrypt the data with a new KMS key

Question 5

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation fails with an error indicating that the secret cannot be accessed. What is the most likely cause?

Accepted Answer

The Lambda rotation function lacks IAM permissions to update the secret. The rotation function must have IAM permissions to read the current secret, update it with new credentials, and modify the database password. If the Lambda function lacks those permissions, it cannot access or update the secret, causing rotation to fail.

Answer

The KMS key used to encrypt the secret is disabled

Answer

The secret is not encrypted

Answer

The secret is not in the same region as the database

Question 6

A company wants to protect data at rest in Amazon S3 using client-side encryption. The application will run on Amazon EC2 instances. Which approach meets these requirements?

Accepted Answer

Use the AWS Encryption SDK to encrypt data before uploading to S3. Client-side encryption requires the encryption process to occur on the client side before data is uploaded to S3. The AWS Encryption SDK is designed for this purpose, allowing you to encrypt data locally on the EC2 instance using your own keys, ensuring that S3 never sees the plaintext data. This meets the requirement to protect data at rest with client-side encryption, as the data is encrypted before leaving the application environment.

Answer

Use SSE-S3 and rely on S3 to manage keys

Answer

Enable S3 default encryption on the bucket

Answer

Use SSE-KMS with a customer managed key

Question 7

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team is concerned about key durability and wants to ensure that keys are not lost if the HSM fails. Which action should be taken?

Accepted Answer

Regularly back up the HSM to an Amazon S3 bucket and restore to a new cluster if needed. AWS CloudHSM supports taking backups of the HSM content to an Amazon S3 bucket. These backups can be used to restore to a new HSM cluster in case of failure, ensuring key durability. Option A is incorrect because CloudHSM clusters are single-region; multi-region clusters are not supported. Option B is incorrect because storing keys on an encrypted EBS volume bypasses the security of the HSM and is not a recommended practice for key durability. Option C is incorrect because AWS KMS cannot directly import keys from CloudHSM; KMS and CloudHSM are separate services with different key management capabilities.

Answer

Create a multi-region CloudHSM cluster

Answer

Store the keys in a file on an encrypted EBS volume

Answer

Use AWS KMS to import the keys from CloudHSM

Question 8

A company wants to encrypt data in transit between an on-premises data center and AWS over a VPN connection. Which AWS service or feature should be used?

Accepted Answer

AWS Site-to-Site VPN. WS Site-to-Site VPN (Option C). AWS Site-to-Site VPN creates encrypted tunnels between an on-premises data center and AWS, securing data in transit. Option A (AWS Route 53 Resolver) is a DNS resolution service and does not encrypt network traffic. Option B (AWS Certificate Manager, ACM) is used to provision and manage SSL/TLS certificates for applications, not for VPN encryption. Option D (Amazon API Gateway) is for creating and managing APIs, not for encrypting data in transit between sites.

Answer

AWS Route 53 Resolver

Answer

AWS Certificate Manager (ACM)

Answer

Amazon API Gateway

Question 9

A company needs to protect sensitive data in Amazon S3 from accidental deletion or overwriting. The data must be retained for at least 7 years after creation. Which combination of S3 features should be used?

Accepted Answer

Enable S3 Object Lock in Governance mode and configure a lifecycle policy to expire objects after 7 years. S3 Object Lock in Governance mode prevents objects from being deleted or overwritten during the retention period, and a lifecycle policy can automatically expire objects after 7 years to meet the retention requirement. Option A is incorrect because Object Lock in Compliance mode also prevents deletion and overwriting, but without specifying a retention period, it does not enforce the 7-year retention; additionally, Compliance mode cannot be overridden, which may be too restrictive. Option B is incorrect because S3 Intelligent-Tiering and lifecycle policies manage storage costs and transitions, not protection against deletion or overwriting. Option C is incorrect because versioning and MFA Delete protect against accidental deletion and preserve overwritten versions, but do not guarantee a 7-year retention period; lifecycle policies would be needed to enforce it.

Answer

Enable S3 Versioning and enable S3 Object Lock in Compliance mode

Answer

Use S3 Intelligent-Tiering and lifecycle policies

Answer

Enable S3 Versioning and MFA Delete

Question 10

Refer to the exhibit. An administrator is investigating why an application that uses KMS for encryption is failing. The IAM role used by the application has the following policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ] }. What is the most likely cause of the failure?

Accepted Answer

The KMS key is disabled. The KMS key is disabled. If the key is disabled, any attempt to use it for decryption will fail, even if the IAM policy allows the kms:Decrypt action. Option A is incorrect because if the key were deleted, the error would be different. Option B is incorrect because the policy does specify the correct key ARN. Option C is incorrect because the policy does allow the kms:Decrypt action.

Answer

The KMS key has been deleted

Answer

The IAM policy does not specify the correct key ARN

Answer

The IAM policy does not allow the kms:Decrypt action

Question 11

A company wants to protect sensitive data in Amazon S3 by ensuring that all objects are encrypted at rest. Which TWO options meet this requirement? (Choose TWO.)

Accepted Answer

Use server-side encryption with S3 managed keys (SSE-S3). Options A and D are correct because they are server-side encryption methods provided by S3 to encrypt objects at rest. SSE-S3 uses S3-managed keys, while SSE-KMS uses AWS KMS keys. Option B (SSL/TLS) protects data in transit, not at rest. Option C (client-side encryption) encrypts data before upload, but it is not an S3 server-side encryption feature and does not rely on S3 for encryption key management; thus it does not meet the requirement of S3 ensuring encryption at rest. Option E (Amazon Macie) is a data classification and discovery service, not an encryption mechanism.

Answer

Use SSL/TLS for data in transit

Answer

Use client-side encryption with the AWS Encryption SDK

Answer

Use Amazon Macie to classify and mask data

Question 12

A company is designing a data protection strategy for Amazon EBS volumes. Which TWO practices should be implemented? (Choose TWO.)

Accepted Answer

Enable encryption by default for new EBS volumes. For data protection of Amazon EBS volumes, enable encryption by default (A) to ensure all new volumes are encrypted. Regular snapshots of EBS volumes stored in a different region (D) provide disaster recovery capability. Option E (EBS multi-attach) is intended for high availability, not data protection, and does not directly protect data. Options B and C are incorrect: S3 Object Lock is for S3 objects, not EBS snapshots; automated backups for RDS are for RDS databases, not EBS volumes.

Answer

Use S3 Object Lock to prevent deletion of snapshots

Answer

Enable automated backups for Amazon RDS

Answer

Use EBS multi-attach for high availability

Question 13

A company needs to protect data in Amazon S3 by ensuring that only authorized users can access objects, and all access is logged. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is correct because it enables you to define granular permissions for S3 objects, ensuring that only authorized users or roles can access them via IAM policies or S3 bucket policies. AWS CloudTrail is correct because it logs all API calls made to S3, including object-level operations like GetObject and PutObject, providing an audit trail for access. Together, they satisfy the requirement of controlling access and logging all access.

Answer

AWS KMS

Answer

AWS WAF

Answer

Amazon CloudWatch

Question 14

A company runs a web application on Amazon EC2 behind an Application Load Balancer (ALB). The application handles payment card information (PCI) and must comply with PCI DSS. The security team wants to ensure that all data in transit between the client and the ALB is encrypted using TLS 1.2 or higher. The ALB currently uses a default certificate from AWS Certificate Manager (ACM) that was issued by Amazon. The compliance team has flagged that the certificate must be issued by a public Certificate Authority (CA) that is trusted by major browsers. The company wants to minimize operational overhead. What should the security team do?

Accepted Answer

Request a public certificate from ACM and associate it with the ALB. AWS Certificate Manager (ACM) can issue public certificates from trusted certificate authorities (CAs) such as Amazon Trust Services at no additional cost. These certificates support TLS 1.2 and 1.3 and are automatically renewed, minimizing operational overhead. ACM public certificates are trusted by major browsers because they are issued by a public CA. Option A is incorrect because CloudHSM is used for hardware-based key management, not for issuing public certificates; importing a certificate from CloudHSM would require manual renewal. Option B is incorrect because CloudFront's default certificate is for CloudFront distributions, not for ALBs; using CloudFront would introduce unnecessary complexity and cost. Option C is incorrect because self-signed certificates are not trusted by browsers and would require manual renewal and distribution.

Answer

Use AWS CloudHSM to generate a certificate and import it into ACM

Answer

Configure CloudFront in front of the ALB and use a CloudFront default certificate

Answer

Generate a self-signed certificate on the EC2 instance and upload it to ACM, then associate it with the ALB

Question 15

A company uses Amazon RDS for MySQL to store customer data. The security team wants to ensure that the database is encrypted at rest. The database is already running and contains production data. The team needs to enable encryption at rest with minimal downtime. What should they do?

Accepted Answer

Create a read replica with encryption enabled, promote it to a standalone instance, and update the application connection string. You cannot enable encryption on an existing RDS instance; you must create a new encrypted instance and migrate. Option B is wrong because you cannot modify the existing instance to add encryption. Option C is wrong because snapshots can be encrypted, but you still need to restore to a new instance. Option D is wrong because you cannot attach encrypted storage.

Answer

Attach an encrypted EBS volume to the RDS instance

Answer

Take a snapshot of the database, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new instance

Answer

Modify the existing DB instance and enable encryption using the AWS CLI