SCS-C02 Data Protection Practice Test 21 — 15 Questions

Question 1

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team is concerned about key durability and wants to ensure that keys are not lost if the HSM fails. Which action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Regularly back up the HSM to an Amazon S3 bucket and restore to a new cluster if needed. AWS CloudHSM supports taking backups of the HSM content to an Amazon S3 bucket. These backups can be used to restore to a new HSM cluster in case of failure, ensuring key durability. Option A is incorrect because CloudHSM clusters are single-region; multi-region clusters are not supported. Option B is incorrect because storing keys on an encrypted EBS volume bypasses the security of the HSM and is not a recommended practice for key durability. Option C is incorrect because AWS KMS cannot directly import keys from CloudHSM; KMS and CloudHSM are separate services with different key management capabilities.

Answer

Create a multi-region CloudHSM cluster

Answer

Store the keys in a file on an encrypted EBS volume

Answer

Use AWS KMS to import the keys from CloudHSM

Question 2

A company is designing a data protection strategy for Amazon EBS volumes. Which TWO practices should be implemented? (Choose TWO.)

Accepted Answer

Enable encryption by default for new EBS volumes. Option A is correct because enabling EBS encryption by default ensures that all newly created EBS volumes in the account/Region are automatically encrypted at rest using AWS KMS keys, protecting data without relying on manual per-volume configuration. Option D is correct because EBS snapshots are incremental, point-in-time backups stored in Amazon S3, and copying them to a different Region provides cross-Region durability and disaster recovery against Regional failures or accidental deletion. Option B is incorrect because S3 Object Lock applies to objects in S3 buckets, not to EBS snapshots, which are managed through EBS snapshot APIs and lifecycle policies. Option C is incorrect because automated backups for Amazon RDS protect RDS databases, not EBS volumes, so it does not address the EBS data protection requirement. Option E is incorrect because EBS Multi-Attach only allows a single io1/io2 volume to be attached to multiple Nitro-based EC2 instances in the same AZ for concurrent access, and it does not provide backup or data protection.

Answer

Use S3 Object Lock to prevent deletion of snapshots

Answer

Enable automated backups for Amazon RDS

Answer

Use EBS multi-attach for high availability

Question 3

A company needs to protect data in Amazon S3 by ensuring that only authorized users can access objects, and all access is logged. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is correct because it enables you to define granular permissions for S3 objects, ensuring that only authorized users or roles can access them via IAM policies or S3 bucket policies. AWS CloudTrail is correct because it logs all API calls made to S3, including object-level operations like GetObject and PutObject, providing an audit trail for access. Together, they satisfy the requirement of controlling access and logging all access.

Answer

AWS KMS

Answer

AWS WAF

Answer

Amazon CloudWatch

Question 4

A company runs a web application on Amazon EC2 behind an Application Load Balancer (ALB). The application handles payment card information (PCI) and must comply with PCI DSS. The security team wants to ensure that all data in transit between the client and the ALB is encrypted using TLS 1.2 or higher. The ALB currently uses a default certificate from AWS Certificate Manager (ACM) that was issued by Amazon. The compliance team has flagged that the certificate must be issued by a public Certificate Authority (CA) that is trusted by major browsers. The company wants to minimize operational overhead. What should the security team do?

Accepted Answer

Request a public certificate from ACM and associate it with the ALB. AWS Certificate Manager (ACM) can issue public certificates that are signed by Amazon's public CA, which is trusted by all major browsers and operating systems. Requesting a public certificate in ACM and associating it with the ALB listener satisfies the PCI DSS requirement for TLS 1.2+ encryption with a publicly trusted CA, while ACM handles renewal automatically — minimising operational overhead. This is the canonical AWS-recommended approach for ALB TLS termination.

Answer

Use AWS CloudHSM to generate a certificate and import it into ACM

Answer

Configure CloudFront in front of the ALB and use a CloudFront default certificate

Answer

Generate a self-signed certificate on the EC2 instance and upload it to ACM, then associate it with the ALB

Question 5

A company is designing a disaster recovery plan for its Amazon RDS for MySQL database. The database must be encrypted at rest. Which approach ensures that the database is encrypted and can be restored in another AWS Region?

Accepted Answer

Create a cross-Region read replica with encryption enabled. (Create a cross-Region read replica with encryption enabled) is correct because it continuously replicates data to another AWS Region and encryption at rest can be enabled, ensuring both disaster recovery and encryption. Option A is wrong because encryption cannot be enabled on an existing unencrypted DB instance; a new encrypted instance must be created. Option B is wrong because exporting to S3 and using cross-Region replication does not provide a real-time database replica and complicates recovery. Option C is wrong because while a manual snapshot can be copied to another Region with encryption, it does not provide continuous replication; it is a point-in-time backup, not a disaster recovery solution that minimizes data loss.

Answer

Enable encryption on the existing DB instance

Answer

Export the database to Amazon S3 and use S3 cross-Region replication

Answer

Create a manual snapshot and copy it to another Region with encryption

Question 6

A company uses AWS Organizations and wants to enforce that all S3 buckets created in any account within the organization have default encryption enabled. Which policy should be used?

Accepted Answer

Use a service control policy (SCP) to deny creation of buckets without default encryption. (SCP) is correct because a service control policy can be applied to all accounts in an AWS Organization to deny the creation of S3 buckets without default encryption, providing a preventive control. Option A is incorrect because bucket policies are applied per bucket and are not preventive during creation. Option C is incorrect because IAM policies are account-specific and do not cover all accounts in the organization. Option D is incorrect because AWS Config rules are detective, not preventive; they can trigger remediation but do not prevent creation.

Answer

Use a bucket policy on each bucket to enforce encryption

Answer

Use an IAM policy to require encryption on all bucket creation actions

Answer

Use AWS Config rules to automatically enable encryption on new buckets

Question 7

A company uses Amazon EBS volumes for EC2 instances. Security policy requires that all EBS volumes be encrypted at rest. The company already has a default KMS key for EBS encryption. However, some new volumes are created without encryption. What is the most efficient way to enforce encryption for all new EBS volumes?

Accepted Answer

Enable EBS encryption by default in the EC2 console or via the API. Enabling EBS encryption by default in the EC2 console or via the API (EnableEbsEncryptionByDefault) ensures that every new EBS volume created in the region is automatically encrypted with the specified KMS key, without requiring any per-volume action or custom tooling. This is the most efficient, native enforcement mechanism because it operates at the account/region level and applies to all volume creation paths, including those from AMIs, snapshots, and instance launches.

Answer

Use AWS CloudTrail to monitor volume creation and send alerts

Answer

Create an AWS Config rule to detect unencrypted volumes and trigger a Lambda function to encrypt them

Answer

Use a custom AMI that enforces encryption

Question 8

Refer to the exhibit. A security engineer is troubleshooting a decryption failure. The command uses the AWS CLI to decrypt a file. The decryption fails with an 'AccessDeniedException' error. The IAM user has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the most likely cause of the failure?

Accepted Answer

The KMS key policy does not grant the IAM user decrypt permission. KMS decryption requires permission from BOTH the IAM identity-based policy AND the KMS key policy. Even though the IAM policy grants kms:Decrypt on '*', the key policy must also explicitly allow the IAM user (or their account with the right conditions) to use the key. If the key policy does not grant access, the request fails with AccessDeniedException regardless of the IAM policy.

Answer

The IAM user does not have permission to call kms:Decrypt on the specific key

Answer

The ciphertext blob is not valid

Answer

The IAM user is not authorized to use the AWS CLI

Question 9

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application uses an Amazon RDS for MySQL database. The security team requires that all data in transit between the EC2 instances and the database be encrypted. The database is in a private subnet. The EC2 instances are in a public subnet. The security team also wants to minimize latency. What should be done to meet these requirements?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the application to use encrypted connections. In a typical AWS environment, data in transit between an application and an RDS database can be encrypted using SSL/TLS. RDS for MySQL supports SSL/TLS connections. To meet the requirement, enable SSL/TLS on the RDS instance by downloading the certificate bundle and configuring the DB instance to require encrypted connections. Then, configure the application to use SSL/TLS when connecting to the database. This approach encrypts data in transit with minimal overhead compared to a VPN, which can introduce latency. Option A (using AWS Certificate Manager for the RDS endpoint) is incorrect because ACM is typically used for load balancers and CloudFront, not for direct database connections. While ACM can provide certificates for applications, RDS itself uses its own certificate authority for SSL/TLS. Option B (setting up an IPsec VPN) is unnecessary and adds complexity and latency without providing encryption specific to the database connection; SSL/TLS already meets the requirement. Option C (placing instances in the same subnet and using a NAT gateway) does not encrypt data in transit and increases latency via NAT gateway.

Answer

Use AWS Certificate Manager to issue a certificate for the RDS endpoint

Answer

Set up a VPN connection between the EC2 instances and the RDS instance using an IPsec VPN

Answer

Place the EC2 instances and RDS in the same subnet and use a NAT gateway

Question 10

A company stores sensitive customer data in Amazon S3. The security team has enabled default encryption with SSE-S3 on the bucket. The compliance team requires that all access to the bucket be logged and that any unauthorized access attempts be detected in real time. The company has AWS CloudTrail enabled. Which additional steps should the security team take to meet the compliance requirements?

Accepted Answer

Enable S3 server access logs and enable Amazon GuardDuty with S3 protection. Enabling S3 server access logs captures all requests to the bucket, satisfying the logging requirement, and Amazon GuardDuty with S3 protection can detect suspicious activity in real time, meeting the requirement for real-time detection of unauthorized access. Option B is incorrect because AWS Config rules monitor configuration changes, not real-time threat detection. Option C is incorrect because CloudTrail data events can log S3 operations, but Amazon Detective is for post-incident analysis, not real-time detection. Option D is incorrect because VPC Flow Logs log network traffic, not S3 access, and Amazon Athena is a query service, not a real-time detection tool.

Answer

Enable AWS Config rules to detect unauthorized access

Answer

Enable CloudTrail data events for the S3 bucket and use Amazon Detective

Answer

Enable VPC Flow Logs and use Amazon Athena to analyze logs

Question 11

A company is migrating sensitive customer data to Amazon RDS for MySQL. The security team requires that data be encrypted at rest and in transit. The database will be accessed by a web application running on Amazon EC2 instances in the same VPC. The RDS instance is launched with encryption enabled using an AWS managed KMS key. The security team also enables SSL/TLS for connections. Which additional step is necessary to ensure that the web application uses encrypted connections?

Accepted Answer

Configure the web application's database connection string to use SSL/TLS.. Enabling SSL/TLS on the RDS instance allows encrypted connections, but the web application must be configured to actually use SSL/TLS when connecting. This is done by modifying the database connection string to require SSL/TLS. Without this step, the application may connect without encryption.

Answer

Enable encryption at rest on the EC2 instance's EBS volumes.

Answer

Create an SCP to enforce SSL connections to RDS.

Answer

Grant the EC2 instance's IAM role permission to use the KMS key for decrypting RDS connections.

Question 12

A security engineer is designing a solution to encrypt data at rest in an Amazon DynamoDB table. The data must be encrypted with a customer managed key in AWS KMS that the security team can rotate annually. The DynamoDB table is used by an AWS Lambda function. Which approach should the engineer take to meet these requirements?

Accepted Answer

Create a customer managed KMS key, enable automatic key rotation with a one-year rotation period, and specify this key when creating the DynamoDB table.. Using a customer managed KMS key with automatic rotation set to one year gives the security team control over the key lifecycle. DynamoDB supports specifying a customer managed key at table creation. The Lambda function must have IAM permissions to use the key. This solution meets both the encryption and rotation requirements.

Answer

Enable DynamoDB encryption at rest with the default AWS owned key and configure annual rotation of that key.

Answer

Enable DynamoDB encryption at rest with an AWS managed key and manually rotate the key every year using the AWS CLI.

Answer

Use AWS CloudHSM to generate a custom encryption key and configure DynamoDB to use that key for encryption at rest.

Question 13

A company stores sensitive data in an Amazon S3 bucket. The security team wants to ensure that all objects are encrypted with SSE-KMS using a specific customer managed key, and that any attempt to upload an object without this encryption is denied. The bucket policy must enforce this. Which bucket policy statement should the security engineer use?

Accepted Answer

Two deny statements for s3:PutObject: one where StringNotEquals on s3:x-amz-server-side-encryption is 'aws:kms', and another where StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id is the ARN of the specific KMS key.. To enforce a specific KMS key for SSE-KMS, the bucket policy must deny uploads that either do not use SSE-KMS or do not use the specified key. Using two separate deny statements with StringNotEquals conditions on s3:x-amz-server-side-encryption and s3:x-amz-server-side-encryption-aws-kms-key-id achieves this. A single statement with AND logic would not correctly deny when only one condition is violated.

Answer

A deny statement for s3:PutObject where the condition StringNotEquals on s3:x-amz-server-side-encryption is 'aws:kms' AND StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id is the ARN of the specific KMS key.

Answer

A deny statement for s3:PutObject where the condition StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id is the ARN of the specific KMS key.

Answer

A deny statement for s3:PutObject where the condition StringNotEquals on s3:x-amz-server-side-encryption is 'aws:kms'.

Question 14

A security engineer needs to encrypt a 10 GB file before uploading it to Amazon S3. The encryption must use a customer managed key in AWS KMS, and the engineer wants to minimize the amount of data sent to KMS for encryption. Which approach should the engineer use?

Accepted Answer

Use the AWS Encryption SDK with a customer managed KMS key to encrypt the file locally, then upload the encrypted file to S3.. The AWS Encryption SDK implements envelope encryption locally, using a KMS customer managed key only to encrypt a data key. This minimizes data sent to KMS because only the small data key is transmitted. The encrypted file is then uploaded to S3. This meets the requirements for local encryption and efficient KMS usage.

Answer

Upload the file to S3 using SSE-KMS with the customer managed key, which encrypts the entire file with KMS.

Answer

Use the KMS Encrypt API directly to encrypt the entire file with the customer managed key, then upload the encrypted file to S3.

Answer

Use S3 client-side encryption with a customer provided key (SSE-C) and store the key in AWS KMS.

Question 15

A security engineer is configuring AWS KMS to encrypt data in a new Amazon S3 bucket. The company requires that the KMS key used for encryption automatically rotate its key material every year, and that the rotation be transparent to applications. The engineer creates a customer managed key with key spec SYMMETRIC_DEFAULT and key usage ENCRYPT_DECRYPT. What should the engineer do next to meet the requirement?

Accepted Answer

Enable automatic key rotation on the customer managed key.. AWS KMS customer managed symmetric keys support automatic annual rotation of the backing key material while preserving the same key ID and ARN. This allows existing applications and policies to continue using the key without modification. Enabling automatic rotation satisfies the requirement for transparent yearly rotation. Other options either require manual key replacement, use a key type that does not support rotation, or rely on an AWS managed key that cannot be configured by the customer.

Answer

Enable automatic key rotation on the AWS managed key aws/s3.

Answer

Use an asymmetric KMS key with RSA_2048 and enable automatic rotation.

Answer

Create a new customer managed key each year and update the S3 bucket policy to use the new key.