SCS-C02 Data Protection Practice Test 3 — 15 Questions

Question 1

A company uses AWS KMS to encrypt data in Amazon RDS. The security team discovers that a developer accidentally deleted a customer master key (CMK) used for RDS encryption. What is the impact on the RDS instances that were encrypted with that key?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The RDS instances will become inaccessible and data will be lost. When a customer master key (CMK) in AWS KMS is deleted, the deletion is irreversible after the waiting period (7-30 days). Once deleted, any data encrypted with that key becomes permanently inaccessible because the key material is destroyed. For RDS instances encrypted with that CMK, the data cannot be decrypted, resulting in data loss and inaccessibility. There is no automatic re-encryption or recovery.

Answer

The key deletion can be reversed within 30 days

Answer

The RDS instances will be automatically re-encrypted with a new key

Answer

The RDS instances will continue to operate normally

Question 2

A company uses AWS KMS to encrypt data in Amazon RDS. The security team discovers that a developer accidentally deleted a customer master key (CMK) used for RDS encryption. What is the impact on the RDS instances that were encrypted with that key?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a KMS key policy that grants kms:Decrypt only to the IAM role. A KMS key policy is the primary access control for KMS keys. By setting a key policy that grants kms:Decrypt only to the specific IAM role, you ensure that no other principal can use the key to decrypt, even if they have S3 permissions. This is the most secure way because it directly restricts the cryptographic operation at the key level.

Answer

Apply an S3 bucket policy that denies all principals except the IAM role

Answer

Use S3 access logs to monitor unauthorized decryption attempts

Answer

Attach an IAM policy to the role granting kms:Decrypt permission

Question 3

A company needs to share an encrypted Amazon Machine Image (AMI) with another AWS account. The AMI was encrypted using a customer managed key (CMK) in AWS KMS. What steps are required to allow the target account to launch an EC2 instance from the shared AMI?

Accepted Answer

Modify the AMI launch permissions to include the target account and add the target account to the KMS key policy. Both the AMI launch permissions and the KMS key policy must grant access to the target account. Option B is wrong because copying the AMI does not automatically share the KMS key; the key policy still needs to be updated. Option C is wrong because modifying only AMI launch permissions does not grant the target account permission to use the KMS key for decryption. Option D is wrong because adding the target account to the KMS key policy alone does not grant access to the AMI; the AMI launch permissions must also be modified.

Answer

Copy the AMI and share the copy; the key is automatically shared

Answer

Only modify the AMI launch permissions to include the target account

Answer

Only add the target account to the KMS key policy

Question 4

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team needs to ensure that automated backups are also encrypted. How can this be achieved?

Accepted Answer

Enable encryption at rest on the RDS instance; backups are automatically encrypted. Enabling encryption at rest on the RDS instance automatically encrypts backups. Option A is incorrect because manual encryption of backups is not required and is not practical. Option C is incorrect because RDS does not support Copy-on-Write for encrypting backups. Option D is incorrect because simply storing backups in an encrypted S3 bucket does not encrypt the backup files unless they are encrypted at rest by RDS.

Answer

Manually encrypt each backup using AWS KMS before storing in S3

Answer

Use RDS Copy-on-Write to encrypt backups

Answer

Create an encrypted S3 bucket and store backups there

Question 5

A company is designing a data lake on Amazon S3 and needs to encrypt data at rest. The compliance team requires that the encryption keys be managed by the company and not by AWS. Which encryption option should be used?

Accepted Answer

SSE-C. (SSE-C) is correct because SSE-C allows the customer to provide their own encryption keys, meeting the compliance requirement that keys be managed by the company and not by AWS. Option B (SSE-S3) is incorrect because AWS manages the keys. Option D (SSE-KMS) is incorrect because even with customer-managed keys, AWS KMS stores and manages the keys. Option C (client-side encryption) is not server-side encryption and would require the customer to manage encryption before upload, but the question specifically asks for encryption at rest on S3, and server-side options are appropriate; SSE-C is the only server-side option where AWS does not manage the keys.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 6

A company is implementing a data protection strategy for Amazon S3. Which TWO actions should be taken to protect data from accidental deletion or overwrite?

Accepted Answer

Enable MFA Delete on the bucket. Option B (Enable MFA Delete on the bucket) is correct because MFA Delete requires additional authentication via a valid MFA device to permanently delete an object version or to change the versioning state of the bucket, which directly protects against accidental or malicious deletion. Option D (Enable S3 Versioning on the bucket) is correct because versioning keeps multiple variants of an object in the same bucket, so an overwrite creates a new version rather than destroying the prior data, and a delete simply adds a delete marker, allowing recovery of the previous version. Option A (cross-region replication) is not correct here because it copies objects to another bucket for durability and compliance, but it does not prevent accidental deletion or overwrite in the source bucket. Option C (a bucket policy denying s3:DeleteObject) is not correct because it blocks only the DeleteObject API call and does not stop an overwrite via PutObject, nor does it provide recovery of overwritten data. Option E (default encryption) is not correct because encryption protects data confidentiality at rest and does not prevent deletion or overwrite.

Answer

Enable cross-region replication

Answer

Apply a bucket policy that denies s3:DeleteObject

Answer

Enable default encryption on the bucket

Question 7

A company is designing a disaster recovery plan for encrypted Amazon EBS volumes. Which THREE steps are required to ensure that encrypted EBS snapshots can be restored in a different AWS Region?

Accepted Answer

Copy the encrypted snapshot to the target AWS Region. To restore encrypted EBS snapshots in a different AWS Region, you must copy the encrypted snapshot to the target region (B) and ensure the customer managed key (CMK) used for encryption is available in the target region (D). Re-encrypting the snapshot with a CMK in the target region (A) is optional if you want to use a different key, but it is not a required step. Options C and E are incorrect because AWS CloudHSM is not used for EBS encryption and sharing snapshots via AWS RAM does not guarantee key availability.

Answer

Re-encrypt the snapshot with a customer managed key (CMK) in the target region

Answer

Store the encryption key in AWS CloudHSM in the target region

Answer

Share the snapshot with the target region using AWS RAM

Question 8

A company wants to protect sensitive data in Amazon S3 from unauthorized access. Which TWO AWS services can be used to detect and alert on suspicious access patterns?

Accepted Answer

AWS CloudTrail. Options A and E are correct. Amazon Macie uses machine learning to discover, classify, and protect sensitive data in S3, and it can alert on suspicious access patterns. AWS CloudTrail logs all API calls to S3, which can be analyzed to detect unauthorized access. Option B (AWS Config) is incorrect because it assesses compliance and tracks configuration changes but does not focus on data access patterns. Option C (Amazon CloudWatch Logs) is incorrect because while it can store S3 access logs, it does not inherently analyze for suspicious patterns without additional services like CloudWatch Logs Insights. Option D (Amazon GuardDuty) is incorrect because although it detects threats across AWS accounts, it is not specifically for S3 data access patterns; its primary focus is on network and account-level threats.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 9

A security engineer is reviewing a KMS key policy. What does this policy accomplish?

Accepted Answer

Allow the SecurityAudit role to decrypt and re-encrypt data only from the same AWS account. The KMS key policy grants the SecurityAudit role permission to use the key for cryptographic operations (Decrypt, ReEncrypt, GenerateDataKey, etc.) while the condition restricts usage to requests originating from the same AWS account, preventing cross-account access. This is the standard pattern for allowing an audit role to inspect encrypted data without opening the key to other accounts.

Answer

Deny decryption to the SecurityAudit role

Answer

Allow the SecurityAudit role to use the key only for specific KMS keys

Answer

Allow any user from account 123456789012 to use the key

Question 10

A security engineer is reviewing the configuration of an S3 bucket. What is a security concern with the current configuration?

Accepted Answer

The bucket policy grants public read access to all objects. A bucket policy granting public read access to all objects exposes every object in the bucket to anyone on the internet, which is a critical data-exposure risk and a common cause of breaches. This is the security concern in the configuration.

Answer

Versioning is enabled, which increases storage costs

Answer

The lifecycle rule will permanently delete current versions after 30 days

Answer

MFA Delete is enabled, which blocks legitimate administrative actions

Question 11

A security engineer needs to ensure that all data in an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must deny any PutObject request that does not include the x-amz-server-side-encryption header with value aws:kms. Which bucket policy element should be used?

Accepted Answer

Deny with condition StringNotEquals for s3:x-amz-server-side-encryption. To enforce encryption at rest with KMS, a bucket policy should use a Deny effect on s3:PutObject with a condition that the s3:x-amz-server-side-encryption header is not equal to aws:kms (using StringNotEquals). This denies any PutObject request that does not specify the required encryption. Option A is incorrect because NotPrincipal is used for denying specific principals, not for enforcing conditions. Option C is incorrect because s3:PutObjectAcl is used for setting ACLs, not encryption. Option D is incorrect because an Allow with StringEquals would only allow requests with the correct header, but would not deny requests without it; a Deny is needed to explicitly block noncompliant requests.

Answer

Deny with NotPrincipal

Answer

Deny on s3:PutObjectAcl

Answer

Allow with condition StringEquals for s3:x-amz-server-side-encryption

Question 12

A company is using AWS CloudHSM to store encryption keys for a custom application. The application needs high availability across two AWS Regions. What is the MOST secure and cost-effective approach to synchronize key material between the HSMs in each Region?

Accepted Answer

Create a backup of the source HSM and restore it to the target HSM in the second region. The correct approach is to create a backup of the source HSM and restore it to the target HSM in the second region. CloudHSM does not automatically synchronize key material across clusters or regions. Backup and restore is the supported and secure method to copy key material. Option A is incorrect because AWS KMS multi-Region keys cannot be backed by CloudHSM custom key stores across regions, and KMS does not synchronize keys across regions automatically. Option C is incorrect because exporting key material via encrypt/decrypt APIs exposes the key in plaintext and is not a secure method for synchronization. Option D is incorrect because the CloudHSM client does not provide cross-region replication functionality; it only manages local HSM operations.

Answer

Use AWS KMS multi-Region keys with custom key store backed by CloudHSM

Answer

Export the key material from the source HSM using the encrypt/decrypt API and import into the target HSM

Answer

Use the AWS CloudHSM client to replicate the key material automatically across regions

Question 13

A company is migrating a legacy application to AWS. The application stores sensitive data and must comply with PCI DSS. The security team needs to ensure that data is encrypted at rest using keys that are rotated every 12 months. Which THREE steps should the team take?

Accepted Answer

Enable AWS CloudTrail to log all KMS key usage. Option A is correct because AWS CloudTrail records every KMS API call (Encrypt, Decrypt, GenerateDataKey, RotateKey, etc.), which is required for PCI DSS audit trails and for proving that key rotation and usage policies are enforced. Option B is correct because envelope encryption is the AWS-recommended pattern: the application encrypts data with a unique data key and then encrypts that data key under a KMS customer managed key, which limits the amount of data protected directly by the KMS key and supports rotation of the underlying CMK. Option D is correct because AWS KMS customer managed keys support automatic annual rotation (rotation period of 365 days), satisfying the requirement that keys be rotated every 12 months while keeping the key material managed by AWS. Option C is not appropriate because CloudHSM keys are not automatically rotated by AWS and require manual rotation, adding operational burden not required by the scenario. Option E is incorrect because SSE-C3 is not a valid S3 encryption option (the valid server-side options are SSE-S3, SSE-KMS, and SSE-C), and a bucket policy alone cannot enforce encryption at rest with rotated KMS keys.

Answer

Use AWS CloudHSM to generate and store keys, and manually rotate them every 12 months

Answer

Use S3 bucket policy to enforce SSE-C3 encryption

Question 14

A security engineer is designing a data protection strategy for an S3 bucket that contains sensitive data. The data must be encrypted at rest and the key material must be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated. Which TWO services can be used to meet these requirements?

Accepted Answer

AWS CloudHSM. Option C (AWS CloudHSM) is correct because CloudHSM provides dedicated, single-tenant hardware security modules that are FIPS 140-2 Level 3 validated, allowing the key material to be generated and stored inside the HSM, which satisfies the requirement for HSM-backed keys at that validation level. Option D (AWS KMS with a custom key store backed by CloudHSM) is correct because a KMS custom key store lets KMS use an AWS CloudHSM cluster as its backing store, so the key material resides in FIPS 140-2 Level 3 validated HSMs while still benefiting from KMS key management and integration with S3. Option A (SSE-C) is not correct because with SSE-C the customer supplies the key material and AWS does not store it in an HSM, so it cannot meet the HSM/FIPS 140-2 Level 3 requirement. Option B (SSE-S3) is not correct because S3 managed keys are stored and managed by AWS in a shared, non-HSM-specific manner that does not provide customer-controlled FIPS 140-2 Level 3 HSM storage. Option E (AWS KMS with default key store) is not correct because the default KMS key store uses AWS-managed HSMs that are FIPS 140-2 validated but are multi-tenant and not the dedicated, customer-controlled HSM storage implied by the requirement.

Answer

S3 server-side encryption with customer-provided keys (SSE-C)

Answer

S3 server-side encryption with S3 managed keys (SSE-S3)

Answer

AWS KMS with default key store

Question 15

A company has a requirement to encrypt all data in an S3 bucket using keys that are stored in an on-premises HSM. Which S3 encryption option should be used?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the customer to provide their own encryption keys with each request, and those keys never persist in AWS. Since the requirement is to use keys stored in an on-premises HSM, SSE-C is the only S3 server-side encryption option that supports externally managed keys supplied at request time. SSE-KMS and SSE-S3 use AWS-managed or KMS-managed keys, which would not satisfy the on-premises HSM requirement.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS