SCS-C02 Data Protection Practice Test 20 — 15 Questions

Question 1

A company is using AWS KMS to encrypt data in Amazon S3. The security team discovers that an S3 bucket has a bucket policy that allows s3:PutObject without requiring encryption. What is the risk?

Accepted Answer

Data can be uploaded without encryption at rest. When the bucket policy allows s3:PutObject without requiring encryption (e.g., x-amz-server-side-encryption header), data can be uploaded as plaintext and stored without encryption at rest, violating data protection requirements. Option A is incorrect because the KMS key usage is controlled by KMS policies, not the bucket policy. Option B is incorrect because authentication is required for PutObject, but encryption is not enforced. Option C is incorrect because encryption in transit (TLS) is separate from encryption at rest.

Answer

The KMS key can be used by unauthorized users

Answer

Data can be downloaded without authentication

Answer

Data in transit is not encrypted

Question 2

Which TWO of the following are valid ways to enforce encryption at rest for data in Amazon S3? (Choose TWO.)

Accepted Answer

Use SSE-KMS. SSE-KMS (option D) is correct because it enforces server-side encryption at rest by having Amazon S3 encrypt objects with keys managed in AWS KMS, providing envelope encryption and auditability via CloudTrail. SSE-C (option E) is also correct because it enforces server-side encryption at rest using a customer-provided encryption key that S3 applies to the object, so data is stored encrypted on disk. Option A (SSL/TLS) is incorrect because it only protects data in transit between the client and S3, not data at rest. Option B (IAM policies) is incorrect because IAM controls authorization and permissions, not the encryption of stored objects. Option C (CloudTrail) is incorrect because it records API activity for auditing, not encryption of data at rest.

Answer

Use SSL/TLS

Answer

Use IAM policies

Answer

Use AWS CloudTrail

Question 3

Which TWO of the following are best practices for protecting data in transit? (Choose TWO.)

Accepted Answer

Enforce HTTPS for web traffic. Option C is correct because enforcing HTTPS for web traffic ensures that HTTP is wrapped in TLS, providing confidentiality and integrity for browser-to-server communications and preventing eavesdropping or man-in-the-middle tampering on the wire. Option D is correct because using SSL/TLS for all data transfers applies strong, standardized transport encryption (e.g., TLS 1.2/1.3) to any protocol carrying sensitive data, which is the core best practice for protecting data in transit. Option A is not the best answer because a VPN encrypts traffic over an untrusted network but does not by itself secure application-layer transfers end-to-end, and 'all traffic' is overly broad rather than a targeted transit-protection control. Option B is wrong because plain HTTP transmits data unencrypted and is unsuitable even for internal traffic. Option E is wrong because encryption at rest protects stored data, not data moving across a network.

Answer

Use a VPN for all traffic

Answer

Use HTTP for internal traffic

Answer

Use encryption at rest

Question 4

Which THREE of the following are valid key management features of AWS KMS? (Choose THREE.)

Accepted Answer

Importing key material. AWS KMS allows you to import your own key material (BYOK) for use with KMS keys, which is a valid key management feature. This is done via the 'ImportKeyMaterial' API, enabling you to create a KMS key with no key material and then upload your own symmetric key material. This feature is essential for meeting compliance requirements that mandate control over the key material lifecycle.

Answer

SSL certificate management

Answer

Password generation

Question 5

A company is using AWS KMS to encrypt data in Amazon S3. The security team discovers that an S3 bucket has a bucket policy that allows s3:PutObject without requiring encryption. What is the risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

KMS key policy with a condition that the principal must be the specific IAM role. KMS key policies are the main mechanism to control access to KMS keys. By specifying the IAM role as the principal in a key policy statement for the kms:Decrypt action, only that role can decrypt using the key. Option A is incorrect because KMS grants are intended for temporary or cross-account access and are not the best practice for permanent control. Option B is incorrect because IAM policies alone are not sufficient if the key policy does not allow the role; both policies must align. Option C is incorrect because S3 bucket policies control access to S3 operations, not KMS decryption permissions directly.

Answer

KMS grant that gives the IAM role decrypt permissions for the key

Answer

IAM policy attached to the role that allows kms:Decrypt for the key

Answer

S3 bucket policy that denies decrypt unless the requester is the specific IAM role

Question 6

A security engineer is troubleshooting an issue where an Amazon RDS for MySQL DB instance is not encrypting data at rest. The DB instance was created without encryption. The engineer needs to enable encryption without significant downtime. What is the MOST effective approach?

Accepted Answer

Take a snapshot, copy it with encryption enabled, and restore a new DB instance from the encrypted snapshot. To enable encryption on an unencrypted RDS DB instance with minimal downtime, you must take a snapshot, copy it with encryption enabled, and then restore a new DB instance from the encrypted snapshot. This creates a new encrypted instance, and you can then switch applications to it. The process requires some downtime during the switch, but it's the most effective method because RDS does not support enabling encryption in-place on an existing unencrypted instance.

Answer

Take a snapshot of the DB instance and enable encryption on the snapshot

Answer

Modify the DB instance and enable encryption in the console

Answer

Create a read replica with encryption and promote it

Question 7

A company uses AWS CloudHSM to store encryption keys. The security team wants to ensure that keys stored in CloudHSM are backed up and can be restored in another AWS Region. What is the BEST approach?

Accepted Answer

Export the security domain from the source cluster and import it into a new cluster in the target region. AWS CloudHSM allows you to export the security domain from a source cluster, which contains the cryptographic material needed to back up and restore keys. You can then create a new CloudHSM cluster in the target region and import the security domain to restore the keys. Option A is incorrect because CloudHSM does not support automatic cross-region replication. Option B is incorrect because HSM user credentials alone do not contain the key material; they are used for authentication, not backup. Option C is incorrect because AWS Backup does not integrate with CloudHSM to back up the cluster's keys.

Answer

Enable automatic cross-region replication on the CloudHSM cluster

Answer

Copy the HSM user credentials and use them in the new region

Answer

Use AWS Backup to back up the CloudHSM cluster and restore in another region

Question 8

A company needs to ensure that data in transit between an on-premises data center and Amazon S3 is encrypted. The data will be transferred using HTTPS. What additional step should be taken to ensure the encryption is enforced?

Accepted Answer

Add a bucket policy that denies requests where aws:SecureTransport is false. S3 bucket policies can enforce encryption in transit by denying any request where the aws:SecureTransport condition key is false. This ensures that only HTTPS (TLS) requests are allowed, effectively blocking HTTP access. Since the data is already being transferred over HTTPS, adding this policy guarantees that encryption in transit is enforced and cannot be bypassed.

Answer

Use AWS KMS to require encryption in transit

Answer

Enable S3 Transfer Acceleration

Answer

Use Amazon CloudFront with HTTPS only

Question 9

A company uses AWS Secrets Manager to store database credentials. The security team needs to ensure that secrets are automatically rotated every 30 days. The rotation function must be implemented with minimal operational overhead. Which approach should be used?

Accepted Answer

Enable automatic rotation in Secrets Manager and configure the rotation interval to 30 days. AWS Secrets Manager has native, built-in rotation support that requires only enabling rotation and specifying a rotation interval and a Lambda rotation function (AWS provides templates for RDS, Redshift, DocumentDB, etc.). Setting the interval to 30 days satisfies the requirement with the least operational overhead because Secrets Manager manages the schedule, invokes the Lambda, and updates the secret version automatically.

Answer

Create an Amazon EventBridge rule that triggers a Lambda function to rotate the secret

Answer

Use AWS CLI to schedule a cron job that runs every 30 days and rotates the secret

Answer

Use Amazon CloudWatch Events to invoke an AWS Lambda function that updates the secret

Question 10

Which TWO of the following are valid options for encrypting data at rest in Amazon S3? (Choose 2.)

Accepted Answer

SSE-S3. SSE-S3 is correct because it provides server-side encryption where Amazon S3 manages the encryption keys entirely. When you upload an object, S3 encrypts it using AES-256 before writing to disk and decrypts it when you access it, with no additional configuration needed beyond enabling the header `x-amz-server-side-encryption: AES256`.

Answer

SSL/TLS encryption

Answer

IAM policy encryption

Answer

CloudHSM client-side encryption

Question 11

Which TWO of the following are valid methods to enforce encryption at rest for an Amazon RDS for PostgreSQL DB instance? (Choose 2.)

Accepted Answer

Restore a DB instance from an encrypted snapshot. Option B is correct because restoring from an encrypted snapshot is a supported way to obtain an encrypted DB instance: you can encrypt a snapshot copy (or use an already encrypted snapshot) and restore it, producing a DB instance with encryption at rest enabled via KMS. Option E is correct because encryption at rest for Amazon RDS for PostgreSQL must be specified at creation time; when you create a new DB instance you can enable encryption, and the underlying storage, automated backups, read replicas, and snapshots are then encrypted with the selected AWS KMS key. Option A is not valid because you cannot enable encryption on an existing unencrypted RDS DB instance in place; you must create an encrypted copy/restore. Option C is not valid because you cannot take a snapshot of an unencrypted instance and simply 'enable encryption on the snapshot' in place; you must copy the snapshot with encryption enabled. Option D is not valid because an encrypted read replica cannot be created from an unencrypted source instance, so this method cannot enforce encryption at rest for the original unencrypted DB instance.

Answer

Enable encryption on an existing unencrypted DB instance

Answer

Take a snapshot of the unencrypted instance and enable encryption on the snapshot

Answer

Create an encrypted read replica and promote it

Question 12

A company stores sensitive customer data in Amazon S3. They want to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. Which S3 bucket policy statement should be added to deny uploads that do not request SSE-KMS?

Accepted Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'aws:kms'. The condition 's3:x-amz-server-side-encryption' with value 'aws:kms' enforces that objects are uploaded with SSE-KMS. Option A is incorrect because 'AES256' enforces SSE-S3, not SSE-KMS. Option C is incorrect because 'aws:SourceArn' is used for cross-account access, not encryption enforcement. Option D is incorrect because requiring the specific KMS key ID is too restrictive; the policy should only require the encryption type, not a particular key.

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption' is 'AES256'

Answer

Deny PutObject unless 'aws:SourceArn' equals the bucket ARN

Answer

Deny PutObject unless 's3:x-amz-server-side-encryption-aws-kms-key-id' is present

Question 13

A security engineer is configuring a new Amazon RDS for MySQL database. The compliance team requires that all database connections be encrypted in transit. Which configuration ensures this requirement is met?

Accepted Answer

Enable the 'require_secure_transport' parameter in the DB parameter group. Setting the 'require_secure_transport' parameter to '1' in the DB parameter group forces all connections to the RDS for MySQL instance to use TLS/SSL encryption. This ensures that data in transit is encrypted, meeting the compliance requirement. The parameter enforces that only encrypted connections are accepted, rejecting any unencrypted attempts.

Answer

Enable encryption at rest using KMS

Answer

Enable IAM database authentication

Answer

Set the 'ssl' parameter to '1' in the DB parameter group

Question 14

A financial company uses AWS KMS to encrypt sensitive data. The security team notices that a KMS key has been deleted, but the encrypted data is still needed for a short period. What is the fastest way to make the data decryptable again?

Accepted Answer

Cancel the key deletion within the waiting period. When a KMS key is scheduled for deletion, there is a waiting period (7-30 days) during which the deletion can be cancelled, restoring the key and making the data decryptable. Option A is incorrect because AWS Support cannot recover a deleted KMS key. Option C is incorrect because CloudHSM backups are unrelated to KMS key material. Option D is incorrect because re-encrypting with a new key would require the original key to decrypt first.

Answer

Contact AWS Support to recover the key material

Answer

Restore the key from a CloudHSM backup

Answer

Re-encrypt the data with a new KMS key

Question 15

A company wants to protect data at rest in Amazon S3 using client-side encryption. The application will run on Amazon EC2 instances. Which approach meets these requirements?

Accepted Answer

Use the AWS Encryption SDK to encrypt data before uploading to S3. Client-side encryption requires the encryption process to occur on the client side before data is uploaded to S3. The AWS Encryption SDK is designed for this purpose, allowing you to encrypt data locally on the EC2 instance using your own keys, ensuring that S3 never sees the plaintext data. This meets the requirement to protect data at rest with client-side encryption, as the data is encrypted before leaving the application environment.

Answer

Use SSE-S3 and rely on S3 to manage keys

Answer

Enable S3 default encryption on the bucket

Answer

Use SSE-KMS with a customer managed key