SCS-C02 Data Protection Practice Test 4 — 15 Questions

Question 1

A company is using AWS DMS to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The data must be encrypted in transit. What should the company do?

Accepted Answer

Enable SSL on the source and target endpoints in the DMS task.. AWS DMS supports SSL/TLS to encrypt data in transit between source and target endpoints. Enabling SSL on both endpoints ensures that the data migration is encrypted over the network. Option A is incorrect because AWS Direct Connect provides a private network connection but does not automatically encrypt traffic; additional encryption like SSL is still required for data in transit. Option C is incorrect because AWS KMS is used for encryption at rest, not for encrypting data in transit. Option D is incorrect because a VPN connection provides a secure tunnel but is not necessary; DMS can use SSL directly on the endpoints, which is a simpler solution.

Answer

Use AWS Direct Connect to establish a private connection.

Answer

Use AWS KMS to encrypt the data before sending.

Answer

Set up a VPN connection between the on-premises network and AWS VPC.

Question 2

A company wants to ensure that data at rest in Amazon EBS volumes is encrypted. What is the simplest way to achieve this?

Accepted Answer

Enable EBS encryption by default in the AWS account.. The simplest method because enabling EBS encryption by default in the AWS account automatically encrypts all newly created EBS volumes without any manual steps. Option B requires creating a custom KMS key and attaching it to each volume, which is more complex. Option C involves manual encryption of each volume, which is not automated. Option D uses operating system-level encryption like LUKS, which is more complex and not integrated with AWS.

Answer

Use AWS KMS to create a custom key and attach it to each volume.

Answer

Encrypt each volume manually using the AWS Management Console.

Answer

Use an operating system-level encryption tool like LUKS.

Question 3

A company wants to protect sensitive data stored in S3 from being accessed by unauthorized users. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use IAM policies to restrict access to the bucket.. Options A and D are correct. IAM policies restrict access to the S3 bucket at the user/role level, and S3 Block Public Access prevents any public access to S3 resources at the account level. Option C is incorrect because default encryption only protects data at rest but does not prevent unauthorized access; it is a data protection mechanism, not an access control mechanism. Option B (versioning) and Option E (MFA Delete) are related to data protection and deletion prevention, respectively, and do not control access to the data.

Answer

Enable S3 Versioning.

Answer

Enable default encryption on all S3 buckets.

Answer

Enable MFA Delete on the bucket.

Question 4

A company is using AWS KMS to encrypt data at rest. The security team needs to ensure that keys cannot be deleted before a retention period. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Enable AWS CloudTrail to log key deletion events.. Options A, B, and E are correct. Enabling CloudTrail to log key deletion events helps audit attempts. Setting CloudWatch alarms on kms:ScheduleKeyDeletion events provides notification. Scheduling key deletion with a waiting period (e.g., 7 days) implements a retention period. Option C is incorrect because IAM policies can prevent deletion but do not enforce a retention period; the question asks to ensure keys cannot be deleted before a retention period, which requires a waiting period, not just denial. Option D is incorrect because automatic rotation does not prevent deletion.

Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion.

Answer

Enable automatic key rotation.

Question 5

A company needs to encrypt data at rest in Amazon RDS for SQL Server. Which TWO methods can be used? (Choose two.)

Accepted Answer

Use SQL Server Transparent Data Encryption (TDE).. Options D and E are correct. Enabling encryption on the DB instance at launch time (Option E) encrypts the entire RDS instance using AWS KMS. SQL Server Transparent Data Encryption (TDE) (Option D) is a built-in feature that encrypts the database at rest at the file level. Option A is incorrect because client-side encryption libraries are used outside of RDS, not as a native RDS feature. Option B is incorrect because column-level encryption with Always Encrypted encrypts specific columns, but it is not a primary method for encrypting the entire RDS instance at rest and is considered a client-side encryption approach. Option C is incorrect because SSL/TLS encrypts data in transit, not at rest.

Answer

Use a client-side encryption library.

Answer

Use column-level encryption with Always Encrypted.

Answer

Use SSL/TLS certificates to encrypt the connection.

Question 6

A security engineer created the following IAM policy for an S3 bucket:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}
```

What does this policy accomplish?

Accepted Answer

It denies uploading objects unless they are encrypted with AWS KMS.. The policy uses a Deny effect on s3:PutObject with a condition that encryption must be "aws:kms". This denies any upload that does not use AWS KMS encryption, effectively requiring objects to be encrypted with KMS. Option A is incorrect because it misinterprets the effect as allowing any encryption. Option B is incorrect because it claims denial of SSE-S3 specifically, but the policy denies non-KMS encryption broadly. Option D is incorrect because the condition does not check for a specific KMS key ID, only the encryption type.

Answer

It allows uploading objects with any server-side encryption.

Answer

It denies uploading objects with SSE-S3 encryption.

Answer

It requires objects to be encrypted with a specific KMS key.

Question 7

The above CLI output shows the encryption configuration for an S3 bucket. What type of encryption is enabled by default?

Accepted Answer

SSE-S3. The output shows 'AES256' which indicates SSE-S3 (Server-Side Encryption with S3-managed keys) is enabled by default. Option A (SSE-C) uses customer-provided keys and is not indicated by AES256 alone. Option B (Client-side encryption) is not a server-side feature and is not shown in the CLI output. Option C (SSE-KMS) would show 'aws:kms' as the encryption type. Therefore, option D is correct.

Answer

SSE-C

Answer

Client-side encryption

Answer

SSE-KMS

Question 8

A company stores sensitive customer data in an S3 bucket. The security team wants to ensure that all data is encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Which bucket policy statement should be added to deny uploads that do not use SSE-KMS?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}. It denies uploads that do not specify SSE-KMS by checking that the 's3:x-amz-server-side-encryption' condition key is not 'aws:kms'. This directly enforces the requirement that all uploads must use SSE-KMS without requiring a specific KMS key ID. Option D is overly restrictive by also requiring a non-null KMS key ID, which is not necessary to meet the stated requirement. Option A lacks any condition, denying all uploads regardless of encryption. Option C checks for 'AES256', which corresponds to SSE-S3, not SSE-KMS.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*"}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket-name/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}

Question 9

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that KMS keys are rotated automatically every year. Which action should be taken?

Accepted Answer

Enable automatic key rotation on the customer managed key.. AWS KMS supports enabling automatic key rotation for customer managed keys (CMKs), which rotates the key material annually without manual intervention. Option B is incorrect because manually rotating keys by creating a new key and updating aliases is unnecessary when automatic rotation can be enabled. Option C is incorrect because AWS managed keys are automatically rotated by AWS approximately every three years, but the customer cannot configure this rotation. Option D is incorrect because CloudTrail logs API calls but does not perform key rotation; using Lambda for rotation adds unnecessary complexity.

Answer

Create a new key and update the alias to point to the new key every year.

Answer

Enable automatic key rotation on the AWS managed key.

Answer

Use an AWS CloudTrail event to trigger a Lambda function that rotates the key.

Question 10

A company uses AWS CloudHSM to generate and store encryption keys for a custom database. The security team needs to back up the keys to another AWS Region for disaster recovery. What is the most secure and efficient way to achieve this?

Accepted Answer

Create a backup of the source CloudHSM cluster and copy the backup to the destination Region.. AWS CloudHSM allows you to create a backup of a cluster and copy that backup to another region using the AWS CLI or console. This is the most secure method as it avoids exporting keys in plaintext. Option B is incorrect because CloudHSM does not support exporting keys directly; you must use backups. Option C is incorrect because CloudHSM does not have a cross-region replication feature for clusters. Option D is incorrect because copying keys via an on-premises HSM is unnecessary and less secure than using CloudHSM's built-in backup copy functionality.

Answer

Export the keys from the source CloudHSM cluster and import them into a destination cluster in the other Region.

Answer

Enable cross-Region replication on the CloudHSM cluster.

Answer

Use the key_mgmt_util command-line tool to copy the keys to an on-premises HSM, then upload to the destination Region.

Question 11

An application running on Amazon EC2 needs to access an S3 bucket containing sensitive data. The security team wants to avoid storing long-term AWS credentials on the instance. How should the EC2 instance be configured to access S3 securely?

Accepted Answer

Assign an IAM role with S3 permissions to the EC2 instance via an instance profile.. Using an IAM role with an instance profile is the recommended method to grant EC2 instances temporary credentials. Option B is incorrect because storing access keys on the instance is insecure. Option C is incorrect because KMS key policies control encryption key permissions, not direct access to S3 objects. Option D is incorrect because S3 pre-signed URLs are for granting temporary access to specific objects, not for general instance access.

Answer

Store IAM user access keys in the instance's user data.

Answer

Attach a KMS key policy that allows the instance to decrypt S3 objects.

Answer

Generate S3 pre-signed URLs for all objects the instance needs to access.

Question 12

A company is designing a data encryption solution for its Amazon RDS for PostgreSQL database. The database must be encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Enable encryption when creating the RDS instance using a KMS key.. RDS supports encryption at rest for new databases using AWS KMS. Option B is incorrect because there is no separate encryption layer; RDS uses KMS. Option C is incorrect because application-level encryption is not the simplest. Option D is incorrect because RDS does not support CloudHSM for encryption at rest.

Answer

Enable AWS KMS encryption on the RDS instance after creation.

Answer

Use application-level encryption before inserting data into the database.

Answer

Use AWS CloudHSM to encrypt the EBS volumes attached to the RDS instance.

Question 13

A company uses AWS Secrets Manager to rotate secrets for its RDS database. The rotation fails periodically, and the security team needs to troubleshoot. Which CloudWatch metric should be monitored to detect rotation failures?

Accepted Answer

AWS/SecretsManager: SecretRotationSucceeded. The correct metric to monitor for Secrets Manager rotation failures is `AWS/SecretsManager:SecretRotationSucceeded`. When rotation fails, the `SecretRotationSucceeded` metric reports a value of 0, allowing the security team to set alarms. Option A is incorrect because KMS key usage metrics are not specific to rotation. Option C is incorrect because Lambda invocations may not capture all rotation failures and are not a direct indicator. Option D is incorrect because RDS metrics do not include Secrets Manager rotation status.

Answer

AWS/KMS: KeyUsage

Answer

AWS/Lambda: Invocations

Answer

AWS/RDS: DatabaseConnections

Question 14

A company wants to protect data in transit between its on-premises network and Amazon VPC using IPsec VPN. Which AWS service should be used to establish this VPN connection?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN, is correct because it provides IPsec VPN connections between on-premises networks and VPCs. Option A is incorrect because AWS Client VPN is for individual remote users, not site-to-site. Option C is incorrect because AWS Transit Gateway acts as a hub for VPC connections but does not directly provide VPN endpoints; it can be used with Site-to-Site VPN. Option D is incorrect because AWS Direct Connect provides a dedicated physical connection, not an IPsec VPN.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 15

A company stores sensitive documents in an S3 bucket. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted using server-side encryption with AWS KMS. Which S3 bucket feature should be configured?

Accepted Answer

Default encryption. S3 bucket default encryption can be configured to enforce server-side encryption using AWS KMS (SSE-KMS) for all objects uploaded to the bucket. Option B is incorrect because versioning maintains multiple object versions but does not enforce encryption. Option C is incorrect because bucket policies control access permissions, not encryption settings. Option D is incorrect because lifecycle policies manage object transitions and expiration, not encryption enforcement.

Answer

Versioning

Answer

Bucket policy

Answer

Lifecycle policy