SCS-C02 Data Protection Practice Test 2 — 15 Questions

Question 1

Which TWO actions can help protect data at rest in Amazon EBS volumes? (Choose 2.)

Accepted Answer

Enable EBS encryption by default in the AWS Account settings.. Option D is correct because enabling EBS encryption by default in the AWS account settings (via the EC2 console or EnableEbsEncryptionByDefault API) ensures that every new EBS volume and snapshot copy created in that Region is automatically encrypted with a KMS key, protecting data at rest without relying on per-resource manual configuration. Option E is correct because using encrypted EBS volumes with AWS KMS customer-managed keys encrypts the volume's data at rest and gives you control over the key policy, rotation, and audit trail via CloudTrail, which is the core mechanism for EBS data-at-rest protection. Option A is not correct because automatic snapshot encryption by default is not a standalone EBS account setting; snapshot encryption is inherited from the source volume or must be enabled explicitly during copy. Option B is not correct because EC2 instance types do not provide encryption at rest; encryption is a property of the EBS volume and its KMS key, not the instance hardware. Option C is not correct because OS-level encrypted file systems protect data within the guest but do not encrypt the underlying EBS volume blocks at the AWS storage layer, so they are not the EBS-native data-at-rest control being asked for.

Answer

Enable automatic encryption of EBS snapshots by default.

Answer

Use an instance type that supports encryption at rest.

Answer

Configure the operating system to use encrypted file systems.

Question 2

Which THREE practices are recommended for managing encryption keys in AWS KMS? (Choose 3.)

Accepted Answer

Enable automatic rotation of the KMS key annually.. Options B, D, and E are correct. B: Enabling automatic key rotation annually is a best practice to ensure keys are rotated regularly without manual intervention. D: Using key policies to restrict which IAM roles can use the key follows the principle of least privilege. E: Enabling AWS CloudTrail logging to record KMS key usage provides an audit trail for security monitoring. Option A is incorrect because deleting a KMS key immediately can cause permanent data loss; instead, you should schedule key deletion. Option C is incorrect because exporting KMS key material and storing it in an S3 bucket would expose the key material and defeat the purpose of using a managed service like KMS.

Answer

Delete the KMS key immediately when it is no longer needed.

Answer

Export the KMS key material and store it in a secure S3 bucket.

Question 3

Refer to the exhibit. A security engineer reviews the key policy of an AWS KMS customer managed key. The AppRole role is used by an application to encrypt and decrypt data. However, the application is unable to decrypt data. What is the MOST likely cause?

Accepted Answer

The KMS key is disabled.. The KMS key policy grants the AppRole the necessary kms:Encrypt and kms:Decrypt permissions, so the permissions are not the issue. When a KMS customer managed key is disabled, all cryptographic operations including Decrypt fail with a KMSInvalidStateException, regardless of IAM or key policy permissions. Since the application can encrypt but not decrypt, the most likely cause is that the key was disabled after the encryption occurred, or the key state changed.

Answer

The root user does not have permission to use the key.

Answer

The key administrator has not granted the AppRole permission to use the key.

Answer

The kms:Decrypt permission is not granted to the AppRole.

Question 4

A company is migrating on-premises data to AWS using AWS Snowball Edge. The data must be encrypted in transit and at rest. Which combination of steps should be taken?

Accepted Answer

Use Snowball Edge with default encryption settings; data is encrypted at rest and in transit.. AWS Snowball Edge encrypts data at rest using 256-bit encryption and protects data in transit, with keys managed by AWS KMS and never stored on the device in plaintext. This default encryption satisfies the requirement without additional configuration. Client-side encryption, VPN, or manual KMS key application are not required for Snowball Edge's built-in protections.

Answer

Encrypt the data with a client-side tool before copying to Snowball Edge.

Answer

Set up a VPN connection to AWS and transfer data over the VPN.

Answer

Use AWS KMS to generate a key and apply it to the Snowball Edge device.

Question 5

A company needs to protect data stored in S3 from accidental deletion by users. Which S3 feature should be used?

Accepted Answer

S3 Versioning. S3 Versioning protects against accidental deletion by retaining all versions of an object. When a user deletes an object in a versioned bucket, the object is not permanently removed; instead, a delete marker is placed, and the previous versions remain accessible and can be restored. This directly addresses the requirement to protect data from accidental deletion by users.

Answer

S3 Lifecycle policies

Answer

S3 MFA Delete

Answer

S3 Block Public Access

Question 6

A security team wants to audit who accessed an S3 object that contains sensitive data. Which AWS service provides this capability?

Accepted Answer

S3 Server Access Logs. S3 Server Access Logs provide detailed records of requests made to an S3 bucket, including object-level access. Option A (AWS Config) is incorrect because it tracks resource configuration changes, not access. Option B (Amazon CloudWatch Logs) is incorrect because CloudWatch Logs can store logs but does not generate them by default; it could be used to store S3 access logs, but the service that provides the capability is S3 Server Access Logs. Option D (AWS CloudTrail) can log object-level API calls if Data Events are enabled, but S3 Server Access Logs are purpose-built for auditing object access and are more straightforward for this use case.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 7

A company is using AWS KMS to encrypt data at rest. The security team needs to ensure that keys cannot be deleted before a retention period. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Enable AWS CloudTrail to log key deletion events.. Options A, B, and E are correct. Enabling CloudTrail to log key deletion events helps audit attempts. Setting CloudWatch alarms on kms:ScheduleKeyDeletion events provides notification. Scheduling key deletion with a waiting period (e.g., 7 days) implements a retention period. Option C is incorrect because IAM policies can prevent deletion but do not enforce a retention period; the question asks to ensure keys cannot be deleted before a retention period, which requires a waiting period, not just denial. Option D is incorrect because automatic rotation does not prevent deletion.

Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion.

Answer

Enable automatic key rotation.

Question 8

A company needs to encrypt data at rest in Amazon RDS for SQL Server. Which TWO methods can be used? (Choose two.)

Accepted Answer

Use SQL Server Transparent Data Encryption (TDE).. Options D and E are correct. Enabling encryption on the DB instance at launch time (Option E) encrypts the entire RDS instance using AWS KMS. SQL Server Transparent Data Encryption (TDE) (Option D) is a built-in feature that encrypts the database at rest at the file level. Option A is incorrect because client-side encryption libraries are used outside of RDS, not as a native RDS feature. Option B is incorrect because column-level encryption with Always Encrypted encrypts specific columns, but it is not a primary method for encrypting the entire RDS instance at rest and is considered a client-side encryption approach. Option C is incorrect because SSL/TLS encrypts data in transit, not at rest.

Answer

Use a client-side encryption library.

Answer

Use column-level encryption with Always Encrypted.

Answer

Use SSL/TLS certificates to encrypt the connection.

Question 9

A security engineer created the following IAM policy for an S3 bucket:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}
```

What does this policy accomplish?

Accepted Answer

It denies uploading objects unless they are encrypted with AWS KMS.. The policy uses a Deny effect on s3:PutObject with a condition that encryption must be "aws:kms". This denies any upload that does not use AWS KMS encryption, effectively requiring objects to be encrypted with KMS. Option A is incorrect because it misinterprets the effect as allowing any encryption. Option B is incorrect because it claims denial of SSE-S3 specifically, but the policy denies non-KMS encryption broadly. Option D is incorrect because the condition does not check for a specific KMS key ID, only the encryption type.

Answer

It allows uploading objects with any server-side encryption.

Answer

It denies uploading objects with SSE-S3 encryption.

Answer

It requires objects to be encrypted with a specific KMS key.

Question 10

A security engineer examines the above output. The company requires automatic yearly key rotation. What should the engineer do?

Accepted Answer

Run 'aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab'. The key is a customer managed CMK (KeyRotationEnabled: false indicates it's not an AWS managed key, as AWS managed keys have rotation enabled automatically and cannot be disabled). Enabling automatic rotation on a customer managed CMK is done via the 'aws kms enable-key-rotation' CLI command. Option B is incorrect because AWS CloudHSM is not required for key rotation; automatic rotation can be enabled directly on the CMK without manual intervention. Option C is incorrect because replacing the key with an AWS managed key would remove control over rotation and is not a necessary action; the current key can have rotation enabled. Option D is incorrect because if key material is imported, automatic rotation is not supported; the key must be rotated manually.

Answer

Use AWS CloudHSM to generate a new key and rotate manually.

Answer

Replace the key with an AWS managed key.

Answer

Import a key material and enable automatic rotation.

Question 11

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that KMS keys are rotated automatically every year. Which action should be taken?

Accepted Answer

Enable automatic key rotation on the customer managed key.. AWS KMS supports automatic annual rotation of customer managed keys. Enabling automatic key rotation on the customer managed key causes KMS to generate new backing key material every year while preserving the same key ID and alias, so existing ciphertext remains decryptable. This is the correct, native way to meet the yearly rotation requirement.

Answer

Create a new key and update the alias to point to the new key every year.

Answer

Enable automatic key rotation on the AWS managed key.

Answer

Use an AWS CloudTrail event to trigger a Lambda function that rotates the key.

Question 12

A company is using AWS KMS with a customer managed key for encrypting EBS volumes. The security team wants to ensure that only specific IAM roles can use the key for encryption and decryption. What is the best way to achieve this?

Accepted Answer

Attach a resource-based policy (key policy) to the KMS key that allows the specific IAM roles.. A KMS key policy is the primary resource-based access control mechanism for a customer managed key, and it is the only place where you can explicitly define which principals (IAM roles/users) may use the key. Because every KMS key must have a key policy, attaching a policy that names the specific IAM roles is the authoritative and most direct way to restrict encryption/decryption to those roles. Unlike IAM policies alone, the key policy is evaluated as part of every KMS request and can grant access even without an identity-based policy.

Answer

Create a KMS grant that allows the roles to use the key.

Answer

Use an SCP to allow only those roles to use the key.

Answer

Use an IAM policy that grants kms:Encrypt and kms:Decrypt to the roles, and ensure the key policy enables IAM policy access.

Question 13

A company is using AWS Key Management Service (KMS) with a customer managed key. The security team needs to ensure that the key can be rotated automatically every year. Which TWO steps are required?

Accepted Answer

Enable automatic key rotation in the KMS console or API.. The correct answers are B and E. Option B: Automatic key rotation can be enabled in the KMS console or API for customer managed keys. Option E: The key must be a customer managed key (CMK) because automatic rotation is not available for AWS managed keys. Option A is incorrect because CloudTrail is not required for rotation. Option C is incorrect because key material must be generated by AWS KMS (not imported) for automatic rotation, but this is a prerequisite, not a separate step. Option D is incorrect because the KMS service principal does not need permission to rotate the key.

Answer

Enable AWS CloudTrail for the KMS key.

Answer

Ensure the key material is generated by AWS KMS, not imported.

Answer

Grant the KMS service principal permission to rotate the key.

Question 14

A company needs to protect data in transit between an on-premises data center and AWS. Which THREE services can be used to encrypt data in transit?

Accepted Answer

HTTPS. HTTPS (C) encrypts data in transit by wrapping HTTP traffic inside TLS, so any data exchanged over an HTTPS endpoint between on-premises clients and AWS is protected with strong ciphers and server authentication. AWS Site-to-Site VPN (D) establishes an IPsec tunnel between the on-premises customer gateway and an AWS virtual private gateway or transit gateway, encrypting all traffic that traverses the public internet between the two environments. AWS Certificate Manager (E) is correct because it provisions and manages the TLS/SSL certificates that enable HTTPS and other TLS-based endpoints, thereby providing the cryptographic material required to encrypt data in transit. AWS Key Management Service (A) is not correct here because it manages keys for encryption at rest and envelope encryption, not the transport encryption of network traffic itself. AWS Shield (B) is not correct because it is a managed DDoS protection service that mitigates volumetric and layer 7 attacks, but it does not encrypt data in transit.

Answer

AWS Key Management Service (KMS)

Answer

AWS Shield

Question 15

A company is storing sensitive customer data in Amazon S3. The security team requires that all data be encrypted at rest using a key that is rotated automatically every year. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use SSE-S3. SSE-S3 (AES-256) encrypts all objects at rest by default and AWS manages the keys transparently, including automatic key rotation, with zero customer configuration or operational overhead. It meets the requirement of encryption at rest with automatic annual rotation because AWS rotates the underlying S3-managed keys without any action from the customer. Because the customer never manages keys, this is the lowest-overhead option that satisfies the stated requirement.

Answer

Use SSE-C with an AWS-managed key

Answer

Use SSE-KMS with automatic key rotation

Answer

Use client-side encryption with a custom key