SCS-C02 Data Protection Practice Test 20 — 15 Questions

Question 1

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bucket policy does not include the aws:SourceVpce condition.. The AccessDenied error occurs because the S3 bucket policy must include the aws:SourceVpce condition to allow access from the specific VPC endpoint. Without this condition, the bucket policy denies all requests that do not originate from the endpoint, regardless of IAM permissions. Option B is correct because the missing condition is the most likely cause.

Answer

The IAM role does not have sufficient permissions.

Answer

The VPC endpoint policy is blocking the request.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Question 2

A company needs to encrypt data at rest in Amazon EBS volumes. They want to use an AWS managed key that is automatically rotated. Which encryption option should they choose?

Accepted Answer

Enable EBS encryption by default using the AWS managed key for Amazon EBS.. Enabling EBS encryption by default using the AWS managed key for Amazon EBS (alias `aws/ebs`) ensures data at rest is encrypted with a key that is automatically rotated on an annual basis, as required. This key is managed by AWS and requires no manual intervention for rotation, meeting the company's need for a managed, automatically rotated key.

Answer

Use SSE-S3.

Answer

Use a customer-managed KMS key with automatic rotation enabled.

Answer

Use client-side encryption.

Question 3

Refer to the exhibit. A security engineer runs the AWS CLI command shown and receives an AccessDenied error. The IAM user Alice has a policy that grants kms:Decrypt on all resources. What is the most likely cause of the error?

Accepted Answer

The KMS key policy does not grant kms:Decrypt to the IAM user Alice.. The AccessDenied error is caused by the KMS key policy, which explicitly restricts which principals can decrypt using the key. Even though Alice's IAM policy allows kms:Decrypt on all resources, the key policy must also grant her access. If the key policy does not list Alice (or her role) as a principal allowed to decrypt, the request fails. Option A correctly identifies this as the most likely cause.

Answer

The IAM user policy does not allow kms:Decrypt.

Answer

The command uses the wrong key ID.

Answer

The ciphertext blob is corrupted.

Question 4

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted in transit between the company's on-premises data center and AWS. Which solution should be used?

Accepted Answer

Use an AWS Site-to-Site VPN with IPsec to encrypt traffic. An AWS Site-to-Site VPN with IPsec is the correct solution because it creates an encrypted tunnel between the on-premises data center and AWS, ensuring all data in transit is protected. IPsec operates at the network layer (Layer 3) and encrypts the entire IP packet, providing confidentiality and integrity for data moving over the public internet. This directly addresses the requirement to encrypt data in transit between the two environments.

Answer

Use AWS CloudHSM to encrypt the data in transit

Answer

Enable SSE-S3 on the S3 bucket

Answer

Use AWS KMS to encrypt the data before transmission

Question 5

A company is implementing a data protection strategy for its Amazon S3 bucket that contains sensitive data. The company requires that all objects be encrypted at rest using server-side encryption with a customer managed key (SSE-KMS). Additionally, the company wants to ensure that only a specific IAM role can decrypt objects. Which THREE actions should the company take?

Accepted Answer

Attach an IAM policy to the specific role that grants kms:Decrypt on the customer managed key. To enforce SSE-KMS, use a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms (option B). To control decryption, grant kms:Decrypt to the specific role via an IAM policy (option A) and modify the KMS key policy to allow that role (option D). Option C is incorrect because SSE-S3 does not use a customer managed key. Option E is incorrect because client-side encryption is not S3 server-side encryption.

Answer

Use the default S3-managed key (SSE-S3) for encryption

Answer

Use client-side encryption with a customer managed key

Question 6

Refer to the exhibit. A security engineer is reviewing the bucket encryption configuration. The bucket is used to store sensitive data. The company policy requires that all objects be encrypted using AWS KMS with a customer managed key. What should the engineer do to meet the policy?

Accepted Answer

Update the bucket encryption configuration to use SSEAlgorithm: aws:kms and specify a KMS key ID. The current bucket encryption configuration uses SSE-S3 (AES256). To meet the policy requiring KMS with a customer managed key, the engineer must update the bucket's default encryption settings to use SSE-KMS (aws:kms) and specify the KMS key ID. Option C correctly describes this. Option A is incorrect because enabling the bucket key with SSE-S3 does not change the encryption algorithm to KMS. Option B is incorrect because client-side encryption with a KMS key is not a bucket-level configuration; it is applied by the client before upload and does not modify the default server-side encryption setting. Option D is incorrect because adding a bucket policy that requires kms:Encrypt permission for PutObject requests does not enforce server-side encryption with KMS; it only authorizes KMS encryption if used, but objects could still be uploaded without specifying KMS encryption.

Answer

Enable the bucket key and set SSEAlgorithm to AES256

Answer

Use client-side encryption with a KMS key

Answer

Add a bucket policy that requires kms:Encrypt permission for all PutObject requests

Question 7

A company uses AWS KMS to encrypt data in Amazon S3. Security team wants to ensure that only specific IAM roles can decrypt objects. Which KMS key policy configuration should be used?

Accepted Answer

In the key policy, use a Condition block with kms:ViaService set to s3.<region>.amazonaws.com and allow kms:Decrypt for the role.. Using a kms:ViaService condition in the key policy restricts the key usage to requests coming from Amazon S3, and the IAM role's permissions to decrypt are granted via the key policy, ensuring only that role can decrypt via S3. Option A is wrong because without the key policy granting decrypt to the role, the IAM policy alone is insufficient. Option B is wrong because it grants blanket decrypt access to the role without the S3 service restriction, allowing decryption outside S3. Option C is wrong because grants are not the recommended way to control access for IAM roles with S3; key policies with conditions are more appropriate.

Answer

Attach an IAM policy to the role that allows kms:Decrypt, and leave the KMS key policy with default settings.

Answer

In the key policy, use a Principal element specifying the role ARN, and allow kms:Decrypt.

Answer

Use a grant for the role to allow kms:Decrypt for S3 operations.

Question 8

A company is using AWS KMS to encrypt data in Amazon S3. They need to ensure that the KMS key can only be used from within a specific VPC. Which TWO actions should be taken?

Accepted Answer

Create a VPC endpoint for AWS KMS.. A VPC endpoint for AWS KMS allows KMS API calls to be routed through the VPC, ensuring traffic does not traverse the public internet. Option E is correct because you can modify the KMS key policy to include a condition using the kms:SourceVpc key, which restricts use of the KMS key to requests originating from the specified VPC. Option B is incorrect because IAM policies cannot directly restrict based on VPC for KMS; such restrictions must be in the key policy. Option C is incorrect because a VPC endpoint for Amazon S3 does not restrict KMS calls. Option D is incorrect because S3 bucket policies control access to S3 objects, not KMS key usage.

Answer

Attach an IAM policy to the role that denies kms:Decrypt unless the request comes from the VPC.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Add a bucket policy condition to restrict access to the VPC.

Question 9

Refer to the exhibit. An administrator applies this bucket policy to an S3 bucket. Which of the following statements describes the effect of this policy?

Accepted Answer

The policy denies all PutObject requests that do not specify SSE-KMS.. The bucket policy contains two Deny statements: the first denies PutObject when the `x-amz-server-side-encryption` header is not `aws:kms`, and the second denies PutObject when the header is absent (null). Together, they ensure that any upload without SSE-KMS is denied, effectively requiring SSE-KMS for all PutObject requests. Options B, C, and D are incorrect because the policy does not allow any unencrypted uploads or uploads with SSE-S3; it only allows uploads with SSE-KMS.

Answer

The policy allows uploads without encryption but denies uploads with SSE-KMS.

Answer

The policy allows unencrypted uploads but denies uploads with SSE-KMS.

Answer

The policy allows uploads with SSE-S3 but denies uploads with SSE-KMS.

Question 10

A company needs to ensure that data in transit between an EC2 instance and an RDS database is encrypted. Which solution meets this requirement?

Accepted Answer

Enable SSL/TLS on the database connection. SSL/TLS is the appropriate solution to encrypt data in transit between the EC2 instance and the RDS database. It ensures that data is encrypted during transmission, preventing eavesdropping or tampering. Option A is incorrect because a VPN connection encrypts traffic between networks but is unnecessary for direct connectivity within the same VPC; SSL/TLS is more straightforward. Option B is incorrect because encryption at rest protects data stored on disk, not data in motion. Option D is incorrect because client-side encryption would require modifying the application to encrypt data before sending, which does not guarantee encryption of the entire communication channel.

Answer

Use a VPN connection between the VPC and the database

Answer

Enable encryption at rest on the RDS instance

Answer

Use client-side encryption on the application

Question 11

A company has a critical application that stores sensitive data in Amazon DynamoDB. The security team requires that all data stored in DynamoDB is encrypted at rest using a customer-managed KMS key. Additionally, they want to ensure that the key can be rotated automatically every year. Which combination of actions should be taken?

Accepted Answer

Use a customer-managed KMS key and enable automatic key rotation. DynamoDB supports encryption at rest with a customer-managed KMS key, and KMS supports automatic annual rotation for customer-managed keys. Option A is wrong because DynamoDB does not use CloudHSM. Option C is wrong because automatic rotation is not available for AWS managed keys (which DynamoDB uses by default). Option D is wrong because you cannot enable encryption on a table created without encryption except by recreating it.

Answer

Use a CloudHSM key store and enable automatic rotation

Answer

Use an AWS managed KMS key and enable automatic key rotation

Answer

Enable encryption on the existing DynamoDB table and use a customer-managed KMS key

Question 12

Refer to the exhibit. A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All objects must be encrypted with SSE-S3. The policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256, thus enforcing SSE-S3 encryption on all uploads. Therefore, all objects must be encrypted with SSE-S3. Option A is incorrect because the condition is valid. Option B is incorrect because the policy denies unencrypted uploads, preventing objects without encryption headers. Option C is incorrect because the condition specifies AES256 (SSE-S3), not SSE-KMS.

Answer

The policy has no effect because the condition is invalid

Answer

Objects without encryption headers are allowed

Answer

All objects must be encrypted with SSE-KMS

Question 13

A company wants to protect data at rest in Amazon S3 using client-side encryption. The application will run on Amazon EC2 instances. Which approach meets these requirements?

Accepted Answer

Use the AWS Encryption SDK to encrypt data before uploading to S3. Client-side encryption requires the encryption process to occur on the client side before data is uploaded to S3. The AWS Encryption SDK is designed for this purpose, allowing you to encrypt data locally on the EC2 instance using your own keys, ensuring that S3 never sees the plaintext data. This meets the requirement to protect data at rest with client-side encryption, as the data is encrypted before leaving the application environment.

Answer

Use SSE-S3 and rely on S3 to manage keys

Answer

Enable S3 default encryption on the bucket

Answer

Use SSE-KMS with a customer managed key

Question 14

A company needs to protect sensitive data in Amazon S3 from accidental deletion or overwriting. The data must be retained for at least 7 years after creation. Which combination of S3 features should be used?

Accepted Answer

Enable S3 Object Lock in Governance mode and configure a lifecycle policy to expire objects after 7 years. S3 Object Lock in Governance mode prevents objects from being deleted or overwritten during the retention period, and a lifecycle policy can automatically expire objects after 7 years to meet the retention requirement. Option A is incorrect because Object Lock in Compliance mode also prevents deletion and overwriting, but without specifying a retention period, it does not enforce the 7-year retention; additionally, Compliance mode cannot be overridden, which may be too restrictive. Option B is incorrect because S3 Intelligent-Tiering and lifecycle policies manage storage costs and transitions, not protection against deletion or overwriting. Option C is incorrect because versioning and MFA Delete protect against accidental deletion and preserve overwritten versions, but do not guarantee a 7-year retention period; lifecycle policies would be needed to enforce it.

Answer

Enable S3 Versioning and enable S3 Object Lock in Compliance mode

Answer

Use S3 Intelligent-Tiering and lifecycle policies

Answer

Enable S3 Versioning and MFA Delete

Question 15

A company needs to protect data in Amazon S3 by ensuring that only authorized users can access objects, and all access is logged. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is correct because it enables you to define granular permissions for S3 objects, ensuring that only authorized users or roles can access them via IAM policies or S3 bucket policies. AWS CloudTrail is correct because it logs all API calls made to S3, including object-level operations like GetObject and PutObject, providing an audit trail for access. Together, they satisfy the requirement of controlling access and logging all access.

Answer

AWS KMS

Answer

AWS WAF

Answer

Amazon CloudWatch