SCS-C02 Data Protection Practice Test 3 — 15 Questions

Question 1

A security engineer needs to ensure that data at rest in an Amazon RDS for PostgreSQL DB instance is encrypted. Which action should the engineer take?

Accepted Answer

Create a new DB instance with encryption enabled using the AWS CLI or Console.. The correct action is to create a new DB instance with encryption enabled. Amazon RDS encryption at rest is only available when you create a new DB instance; you cannot enable encryption on an existing unencrypted DB instance. Option A is wrong because the rds:ModifyDBInstance permission does not allow toggling encryption; encryption cannot be enabled after creation. Option B is wrong because modifying an existing unencrypted DB instance to enable encryption is not supported. Option C is wrong because enabling automated backups does not automatically encrypt the DB instance. Option D is correct because you must create a new encrypted DB instance, for example, using the AWS CLI with --storage-encrypted or via the Console with the 'Enable encryption' option.

Answer

Grant the rds:ModifyDBInstance permission to allow encryption toggling.

Answer

Modify the existing unencrypted DB instance to enable encryption.

Answer

Enable encryption automatically by enabling automated backups.

Question 2

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to enforce that all S3 PUT requests include a specific encryption context key. Which S3 bucket policy condition key should be used?

Accepted Answer

kms:EncryptionContextKeys. Kms:EncryptionContextKeys checks for the presence of a specific encryption context key. To enforce a key-value pair, you would use kms:EncryptionContext. Option B (kms:ViaService) restricts KMS key usage to a specific service, not encryption context. Option C (s3:x-amz-server-side-encryption) enforces the server-side encryption type, such as AES256 or aws:kms, not the encryption context. Option D (s3:PutObjectEncryption) is not a valid S3 condition key.

Answer

kms:ViaService

Answer

s3:x-amz-server-side-encryption

Answer

s3:PutObjectEncryption

Question 3

A company is implementing a data loss prevention (DLP) solution for data stored in Amazon S3. The data includes personally identifiable information (PII). The company wants to automatically identify and classify PII objects, then apply encryption using AWS KMS with a customer-managed key. Which AWS service should be used to identify PII?

Accepted Answer

Amazon Macie. Amazon Macie is the correct service because it uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data such as PII in Amazon S3. AWS CloudTrail (Option A) logs API calls and does not inspect data content. Amazon GuardDuty (Option C) detects threats and unauthorized behavior, not data classification. AWS Config (Option D) evaluates resource configurations and compliance, not data content. Therefore, Option B is correct.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 4

A company needs to securely store database credentials that are used by an application running on Amazon EC2. The credentials must be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. WS Secrets Manager (Option B). Secrets Manager is designed to securely store secrets like database credentials and provides built-in automatic rotation every 90 days. AWS KMS (Option A) is a key management service, not a secret store. IAM roles for EC2 (Option C) cannot store database credentials; they provide temporary credentials for AWS API calls. AWS Systems Manager Parameter Store (Option D) can store secrets but does not natively support automatic rotation without custom logic using Lambda.

Answer

AWS KMS

Answer

AWS IAM roles for EC2

Answer

AWS Systems Manager Parameter Store

Question 5

A company stores sensitive data in an S3 bucket. The security team wants to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). An application writes objects to the bucket but sometimes fails because the encryption key is not found. What is the MOST likely cause?

Accepted Answer

The KMS key is in a different AWS Region than the S3 bucket.. SSE-KMS requires the KMS key to be in the same AWS Region as the S3 bucket; cross-region keys are not supported. The application fails when it attempts to use a key from a different region. Option B is incorrect because SSE-KMS encryption is allowed by default if the bucket policy permits it, and the issue is key location, not permissions. Option C is incorrect because KMS customer managed keys do not expire; they can only be deleted by schedule. Option D is incorrect because automatic key rotation is not required for SSE-KMS to function; it is an optional security feature.

Answer

The bucket policy does not allow SSE-KMS.

Answer

The KMS key has expired.

Answer

The KMS key does not have automatic rotation enabled.

Question 6

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects be encrypted using server-side encryption with customer-provided keys (SSE-C). An application fails when trying to read an object with the error 'The request includes an invalid header.' What is the MOST likely cause?

Accepted Answer

The application did not include the x-amz-server-side-encryption-customer-key header in the GET request.. SSE-C requires the encryption key to be provided in the request headers; if the key is missing or incorrect, the request fails with an invalid header error. Option A is wrong because SSE-C does not require an encryption context. Option B is wrong because SSE-C does not involve KMS keys. Option D is wrong because SSE-C does not require bucket versioning.

Answer

The application did not specify an encryption context in the request.

Answer

The KMS key used for encryption has been disabled.

Answer

The S3 bucket does not have versioning enabled.

Question 7

A company wants to encrypt data in transit between an Application Load Balancer (ALB) and its targets. Which configuration should be used?

Accepted Answer

Configure the ALB with an HTTPS listener and use HTTPS as the protocol for the target group.. Configuring an HTTPS listener on the ALB and using HTTPS protocol for the target group enables end-to-end encryption between the ALB and its targets. The ALB terminates TLS from the client and can re-encrypt traffic to targets using HTTPS. Option A is incorrect because ALB does not support TCP listeners; only HTTP and HTTPS are supported, and using a Network Load Balancer is not part of the ALB configuration. Option C is incorrect because security groups operate at the network layer and cannot enforce application-level encryption; they only allow or deny traffic based on IP and port. Option D is incorrect because an HTTP listener does not encrypt data in transit, and a security group cannot enforce encryption.

Answer

Configure the ALB with a TCP listener and use Network Load Balancer.

Answer

Configure the ALB security group to allow only encrypted traffic.

Answer

Configure the ALB with an HTTP listener and use a security group to enforce encryption.

Question 8

Which TWO methods can be used to encrypt data at rest in Amazon S3? (Choose 2.)

Accepted Answer

Use SSE-S3 to have Amazon S3 manage the encryption keys.. The correct ways to encrypt data at rest in Amazon S3 are using server-side encryption with S3 managed keys (SSE-S3) and client-side encryption before uploading. SSE-S3 encrypts objects at rest on the server side (Option B). Client-side encryption encrypts data before it is sent to S3, ensuring encryption at rest as well (Option E). Option A is incorrect because a bucket policy can enforce encryption, but it does not actually encrypt data; it only denies uploads without encryption. Option C is wrong because encryption in transit (HTTPS) protects data during transfer, not at rest. Option D is wrong because MFA Delete provides additional protection against accidental deletion, not encryption.

Answer

Set a bucket policy that denies uploads without encryption.

Answer

Enable encryption in transit using HTTPS.

Answer

Enable MFA Delete on the S3 bucket.

Question 9

Refer to the exhibit. A security engineer reviews the key policy of an AWS KMS customer managed key. The AppRole role is used by an application to encrypt and decrypt data. However, the application is unable to decrypt data. What is the MOST likely cause?

Accepted Answer

The KMS key is disabled.. The 'Allow use of the key' statement grants Encrypt, Decrypt, ReEncrypt*, GenerateDataKey*, and DescribeKey actions, which should allow decryption. However, the issue might be that the key is disabled or the application is not using the correct key. The exhibit shows the key policy allows the actions; if decryption fails, the key might be disabled. Option A is wrong because the policy includes kms:Decrypt. Option C is wrong because the Admin role has key administration permissions, but that doesn't affect decryption by AppRole. Option D is wrong because the root principal is allowed full access, so that's not an issue.

Answer

The root user does not have permission to use the key.

Answer

The key administrator has not granted the AppRole permission to use the key.

Answer

The kms:Decrypt permission is not granted to the AppRole.

Question 10

A company uses S3 to store sensitive customer data. They want to ensure that all S3 buckets have encryption enabled at rest. Which S3 feature should be used to automatically enforce encryption on all newly created objects?

Accepted Answer

S3 Bucket Policy with a condition requiring server-side encryption. An S3 bucket policy with a condition requiring server-side encryption (e.g., 's3:x-amz-server-side-encryption': 'aws:kms' or 'AES256') can deny any PutObject request that does not include the encryption header, thereby automatically enforcing encryption on all newly created objects. Option A is incorrect because S3 Block Public Access controls public access, not encryption. Option B is incorrect because S3 Object Lock is for write-once-read-many (WORM) retention, not encryption enforcement. Option D is incorrect because S3 Inventory provides a list of objects and their metadata but does not enforce encryption.

Answer

S3 Block Public Access

Answer

S3 Object Lock

Answer

S3 Inventory

Question 11

A security engineer needs to ensure that an Amazon RDS for MySQL database is encrypted at rest. Which action should be taken?

Accepted Answer

Create a new DB instance with encryption enabled.. Amazon RDS encryption at rest must be enabled when the DB instance is created. You cannot enable encryption on an existing unencrypted instance. Option A is incorrect because client-side encryption encrypts data before it reaches the database, but the question specifies encryption at rest by the database service itself. Option B is incorrect because RDS encryption is applied to the entire DB instance, not to individual databases. Option C is incorrect because you cannot modify an existing unencrypted RDS instance to enable encryption; you must create a new encrypted instance and migrate the data.

Answer

Use a client-side encryption tool to encrypt data before writing to the database.

Answer

Use AWS KMS to encrypt individual databases within the instance.

Answer

Enable encryption on an existing unencrypted DB instance.

Question 12

A company uses AWS KMS to manage encryption keys for sensitive data stored in S3. The security team wants to ensure that keys are rotated automatically every year. What should they do?

Accepted Answer

Enable automatic key rotation on a customer managed key.. Customer managed keys with automatic key rotation enabled rotate automatically every year. Option D is incorrect because AWS managed keys rotate every three years, not every year. Options B and C are incorrect because they require manual rotation and do not meet the yearly automatic rotation requirement.

Answer

Use a custom key store and rotate keys manually.

Answer

Use a CloudHSM to store keys and rotate them manually.

Answer

Use an AWS managed key, which rotates automatically every year.

Question 13

A company wants to share an encrypted Amazon Machine Image (AMI) with another AWS account. The AMI uses an EBS snapshot encrypted with a customer managed key in KMS. What is the correct procedure to allow the other account to launch an EC2 instance from this AMI?

Accepted Answer

Share the AMI, share the snapshot, and grant the target account decrypt permissions on the KMS key.. To share an encrypted AMI (EBS snapshot encrypted with a customer managed KMS key) with another AWS account, you must share the AMI, share the underlying snapshot, and grant the target account decrypt permissions on the KMS key. This allows the target account to launch EC2 instances from the AMI. Option A is incorrect because exporting the snapshot as unencrypted is not possible for encrypted snapshots. Option B is incorrect because the target account cannot use its own KMS key to decrypt a snapshot encrypted with a different key; the source account must grant permissions. Option C is incorrect because sharing only the AMI does not automatically share snapshot permissions; the snapshot must be explicitly shared. Therefore, D is the correct answer.

Answer

Export the snapshot as an unencrypted snapshot and share it.

Answer

Share the AMI and have the target account create a new KMS key to encrypt the snapshot.

Answer

Share only the AMI; the snapshot permissions are inherited from the AMI.

Question 14

A company needs to protect data stored in S3 from accidental deletion by users. Which S3 feature should be used?

Accepted Answer

S3 Versioning. S3 Versioning allows retrieval of overwritten or deleted objects, protecting against accidental deletion. Option A is incorrect because Lifecycle policies manage object transitions and expiration, not deletion protection. Option B is incorrect because MFA Delete adds an extra layer of protection for deletion but is not the primary feature for recovering from accidental deletion; it requires versioning to be enabled. Option D is incorrect because Block Public Access prevents public access to buckets, not deletion.

Answer

S3 Lifecycle policies

Answer

S3 MFA Delete

Answer

S3 Block Public Access

Question 15

A security team wants to audit who accessed an S3 object that contains sensitive data. Which AWS service provides this capability?

Accepted Answer

S3 Server Access Logs. S3 Server Access Logs provide detailed records of requests made to an S3 bucket, including object-level access. Option A (AWS Config) is incorrect because it tracks resource configuration changes, not access. Option B (Amazon CloudWatch Logs) is incorrect because CloudWatch Logs can store logs but does not generate them by default; it could be used to store S3 access logs, but the service that provides the capability is S3 Server Access Logs. Option D (AWS CloudTrail) can log object-level API calls if Data Events are enabled, but S3 Server Access Logs are purpose-built for auditing object access and are more straightforward for this use case.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail