SCS-C02 Data Protection Practice Test 2 — 15 Questions

Question 1

A company needs to encrypt data in transit between an on-premises data center and Amazon S3. Which solution should they use?

Accepted Answer

Use HTTPS endpoints for S3 API calls.. HTTPS (HTTP over TLS) encrypts data in transit between the on-premises data center and Amazon S3 by using TLS 1.2/1.3 to secure the API calls. This ensures that all data transmitted over the network is encrypted end-to-end, protecting it from eavesdropping and man-in-the-middle attacks. AWS S3 enforces HTTPS for all API requests when using the default endpoint, and customers can also configure bucket policies to deny HTTP requests.

Answer

Use AWS KMS to encrypt the data before transmission.

Answer

Use an S3 VPC endpoint.

Answer

Use S3 Transfer Acceleration.

Question 2

A company wants to ensure that data stored in Amazon S3 is encrypted at rest using keys managed by AWS. Which encryption option should they choose?

Accepted Answer

Server-side encryption with S3 managed keys (SSE-S3).. SSE-S3 uses AES-256 encryption keys managed entirely by AWS, fulfilling the requirement for encryption at rest with AWS-managed keys. When you upload an object, S3 encrypts it before writing to disk and decrypts it when you access it, all without any customer action or key management overhead.

Answer

Client-side encryption.

Answer

Server-side encryption with AWS KMS (SSE-KMS).

Answer

Server-side encryption with customer-provided keys (SSE-C).

Question 3

A security engineer needs to ensure that data at rest in an Amazon RDS for PostgreSQL DB instance is encrypted. Which action should the engineer take?

Accepted Answer

Create a new DB instance with encryption enabled using the AWS CLI or Console.. The correct action is to create a new DB instance with encryption enabled. Amazon RDS encryption at rest is only available when you create a new DB instance; you cannot enable encryption on an existing unencrypted DB instance. Option A is wrong because the rds:ModifyDBInstance permission does not allow toggling encryption; encryption cannot be enabled after creation. Option B is wrong because modifying an existing unencrypted DB instance to enable encryption is not supported. Option C is wrong because enabling automated backups does not automatically encrypt the DB instance. Option D is correct because you must create a new encrypted DB instance, for example, using the AWS CLI with --storage-encrypted or via the Console with the 'Enable encryption' option.

Answer

Grant the rds:ModifyDBInstance permission to allow encryption toggling.

Answer

Modify the existing unencrypted DB instance to enable encryption.

Answer

Enable encryption automatically by enabling automated backups.

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to enforce that all S3 PUT requests include a specific encryption context key. Which S3 bucket policy condition key should be used?

Accepted Answer

kms:EncryptionContextKeys. Kms:EncryptionContextKeys checks for the presence of a specific encryption context key. To enforce a key-value pair, you would use kms:EncryptionContext. Option B (kms:ViaService) restricts KMS key usage to a specific service, not encryption context. Option C (s3:x-amz-server-side-encryption) enforces the server-side encryption type, such as AES256 or aws:kms, not the encryption context. Option D (s3:PutObjectEncryption) is not a valid S3 condition key.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

s3:PutObjectEncryption

Question 5

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its targets. Which configuration should be used?

Accepted Answer

Configure the ALB with an HTTPS listener and use HTTPS as the protocol for the target group.. Configuring an HTTPS listener on the ALB and using HTTPS protocol for the target group enables end-to-end encryption between the ALB and its targets. The ALB terminates TLS from the client and can re-encrypt traffic to targets using HTTPS. Option A is incorrect because ALB does not support TCP listeners; only HTTP and HTTPS are supported, and using a Network Load Balancer is not part of the ALB configuration. Option C is incorrect because security groups operate at the network layer and cannot enforce application-level encryption; they only allow or deny traffic based on IP and port. Option D is incorrect because an HTTP listener does not encrypt data in transit, and a security group cannot enforce encryption.

Answer

Configure the ALB with a TCP listener and use Network Load Balancer.

Answer

Configure the ALB security group to allow only encrypted traffic.

Answer

Configure the ALB with an HTTP listener and use a security group to enforce encryption.

Question 6

A company uses AWS KMS to manage encryption keys for sensitive data stored in S3. The security team wants to ensure that keys are rotated automatically every year. What should they do?

Accepted Answer

Enable automatic key rotation on a customer managed key.. Customer managed keys with automatic key rotation enabled rotate automatically every year. Option D is incorrect because AWS managed keys rotate every three years, not every year. Options B and C are incorrect because they require manual rotation and do not meet the yearly automatic rotation requirement.

Answer

Use a custom key store and rotate keys manually.

Answer

Use a CloudHSM to store keys and rotate them manually.

Answer

Use an AWS managed key, which rotates automatically every year.

Question 7

A company needs to protect data stored in S3 from accidental deletion by users. Which S3 feature should be used?

Accepted Answer

S3 Versioning. S3 Versioning allows retrieval of overwritten or deleted objects, protecting against accidental deletion. Option A is incorrect because Lifecycle policies manage object transitions and expiration, not deletion protection. Option B is incorrect because MFA Delete adds an extra layer of protection for deletion but is not the primary feature for recovering from accidental deletion; it requires versioning to be enabled. Option D is incorrect because Block Public Access prevents public access to buckets, not deletion.

Answer

S3 Lifecycle policies

Answer

S3 MFA Delete

Answer

S3 Block Public Access

Question 8

A company wants to ensure that data at rest in Amazon EBS volumes is encrypted. What is the simplest way to achieve this?

Accepted Answer

Enable EBS encryption by default in the AWS account.. The simplest method because enabling EBS encryption by default in the AWS account automatically encrypts all newly created EBS volumes without any manual steps. Option B requires creating a custom KMS key and attaching it to each volume, which is more complex. Option C involves manual encryption of each volume, which is not automated. Option D uses operating system-level encryption like LUKS, which is more complex and not integrated with AWS.

Answer

Use AWS KMS to create a custom key and attach it to each volume.

Answer

Encrypt each volume manually using the AWS Management Console.

Answer

Use an operating system-level encryption tool like LUKS.

Question 9

A company stores sensitive customer data in an S3 bucket. The security team wants to ensure that all data is encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Which bucket policy statement should be added to deny uploads that do not use SSE-KMS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}. It denies uploads that do not specify SSE-KMS by checking that the 's3:x-amz-server-side-encryption' condition key is not 'aws:kms'. This directly enforces the requirement that all uploads must use SSE-KMS without requiring a specific KMS key ID. Option D is overly restrictive by also requiring a non-null KMS key ID, which is not necessary to meet the stated requirement. Option A lacks any condition, denying all uploads regardless of encryption. Option C checks for 'AES256', which corresponds to SSE-S3, not SSE-KMS.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*"}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}

Question 10

An application running on Amazon EC2 needs to access an S3 bucket containing sensitive data. The security team wants to avoid storing long-term AWS credentials on the instance. How should the EC2 instance be configured to access S3 securely?

Accepted Answer

Assign an IAM role with S3 permissions to the EC2 instance via an instance profile.. Using an IAM role with an instance profile is the recommended method to grant EC2 instances temporary credentials. Option B is incorrect because storing access keys on the instance is insecure. Option C is incorrect because KMS key policies control encryption key permissions, not direct access to S3 objects. Option D is incorrect because S3 pre-signed URLs are for granting temporary access to specific objects, not for general instance access.

Answer

Store IAM user access keys in the instance's user data.

Answer

Attach a KMS key policy that allows the instance to decrypt S3 objects.

Answer

Generate S3 pre-signed URLs for all objects the instance needs to access.

Question 11

A company uses AWS KMS to encrypt data in Amazon S3. The security team needs to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. What is the most secure way to enforce this restriction?

Accepted Answer

Set a KMS key policy that grants kms:Decrypt only to the IAM role. By setting a KMS key policy that explicitly grants kms:Decrypt only to the specific IAM role, you enforce that only that role can use the key for decryption, even if other IAM policies allow access. This is the most secure because KMS key policies provide resource-based control directly on the key. Option A is wrong because an S3 bucket policy controls access to S3 objects but not the KMS decryption operation; it cannot prevent someone with KMS decrypt permissions from using the key. Option C is wrong because S3 access logs only record actions, they do not enforce permissions. Option D is wrong because an IAM policy attached to the role grants kms:Decrypt, but that alone does not prevent other roles from also getting the same permission via other policies; the key policy is the authoritative control.

Answer

Apply an S3 bucket policy that denies all principals except the IAM role

Answer

Use S3 access logs to monitor unauthorized decryption attempts

Answer

Attach an IAM policy to the role granting kms:Decrypt permission

Question 12

A company needs to share an encrypted Amazon Machine Image (AMI) with another AWS account. The AMI was encrypted using a customer managed key (CMK) in AWS KMS. What steps are required to allow the target account to launch an EC2 instance from the shared AMI?

Accepted Answer

Modify the AMI launch permissions to include the target account and add the target account to the KMS key policy. Both the AMI launch permissions and the KMS key policy must grant access to the target account. Option B is wrong because copying the AMI does not automatically share the KMS key; the key policy still needs to be updated. Option C is wrong because modifying only AMI launch permissions does not grant the target account permission to use the KMS key for decryption. Option D is wrong because adding the target account to the KMS key policy alone does not grant access to the AMI; the AMI launch permissions must also be modified.

Answer

Copy the AMI and share the copy; the key is automatically shared

Answer

Only modify the AMI launch permissions to include the target account

Answer

Only add the target account to the KMS key policy

Question 13

A company is implementing a data protection strategy for Amazon S3. Which TWO actions should be taken to protect data from accidental deletion or overwrite?

Accepted Answer

Enable MFA Delete on the bucket. Options B and D are correct. Enable S3 Versioning to preserve previous versions of objects, and enable MFA Delete to require multi-factor authentication for destructive operations. Option A is wrong because cross-region replication does not protect against accidental deletion in the source bucket; it only copies objects to another region. Option C is wrong because a bucket policy that denies s3:DeleteObject alone does not prevent overwrites (which use s3:PutObject) and may not cover all deletion scenarios; MFA Delete and versioning are more comprehensive. Option E is wrong because default encryption only encrypts data at rest, it does not prevent deletion or overwrite.

Answer

Enable cross-region replication

Answer

Apply a bucket policy that denies s3:DeleteObject

Answer

Enable default encryption on the bucket

Question 14

A company uses AWS KMS to encrypt data at rest in Amazon RDS for MySQL. The security team needs to ensure that the RDS instance can only be decrypted by a specific IAM role used by the production application, and not by any other IAM user or role. What is the most secure way to achieve this?

Accepted Answer

Modify the KMS key policy to allow 'kms:Decrypt' only for the production role and deny for all other principals.. The most secure way to restrict decryption of an RDS instance encrypted with KMS is to use a KMS key policy. Option D is correct because it modifies the key policy to allow 'kms:Decrypt' only for the production role and deny all other principals. Option B is incorrect because IAM policies cannot be attached directly to a KMS key; key policies are required. Option A is incorrect because key rotation and custom key stores do not restrict access. Option C is incorrect because attaching an IAM role to the RDS instance does not control KMS decryption; the key policy governs access.

Answer

Enable key rotation and use a custom key store to isolate the key.

Answer

Create an IAM policy that denies 'kms:Decrypt' to all principals except the production role, and attach it to the key.

Answer

Attach the production IAM role to the RDS instance and use a condition in the IAM role's policy to allow decrypt.

Question 15

A company is designing a data lake on Amazon S3. The data contains personally identifiable information (PII). The security team requires that all data be encrypted at rest and that access to the data is logged for auditing. Additionally, the team wants to ensure that if an object is accidentally deleted, it can be recovered within 30 days. Which combination of S3 features should be enabled?

Accepted Answer

Enable SSE-KMS, S3 Versioning, and S3 Server Access Logs.. SSE-KMS provides encryption at rest with integrated audit trails via AWS CloudTrail for key usage, S3 Versioning allows recovery of accidentally deleted objects within the versioning retention period (which can be managed via lifecycle policies), and S3 Server Access Logs provide detailed records of requests made to the bucket for auditing. Option A is incorrect because SSE-C does not provide key management audit, and Lifecycle policies do not directly help with recovery of deleted objects. Option B is incorrect because S3 Inventory is used for auditing object metadata and replication, not for recovery or access logging. Option D is incorrect because default encryption with SSE-S3 does not provide per-object key audit trails, and CloudTrail is not primarily for S3 data events (it can log, but Server Access Logs are more detailed).

Answer

Enable SSE-C, S3 Lifecycle policies, and CloudWatch Logs.

Answer

Enable SSE-KMS, S3 Versioning with MFA Delete, and S3 Inventory.

Answer

Enable default encryption (SSE-S3), S3 Versioning, and AWS CloudTrail.