SCS-C02 Data Protection Practice Test 4 — 15 Questions

Question 1

A company uses AWS KMS to encrypt data in S3. The security policy requires that keys be rotated every 12 months. Which type of KMS key supports automatic rotation?

Accepted Answer

Customer managed keys with automatic rotation enabled. Customer managed keys are the only KMS key type that supports automatic annual rotation, configurable via the rotation period setting (default 365 days). AWS managed keys are rotated automatically by AWS on a fixed ~3-year schedule that customers cannot control, and imported key material and custom key store (CloudHSM) keys cannot be auto-rotated by KMS because AWS does not possess the backing key material.

Answer

Imported key material

Answer

Custom key store keys

Answer

AWS managed keys

Question 2

A company uses AWS KMS to encrypt data at rest in Amazon RDS for MySQL. The security team needs to ensure that the RDS instance can only be decrypted by a specific IAM role used by the production application, and not by any other IAM user or role. What is the most secure way to achieve this?

Accepted Answer

Modify the KMS key policy to allow 'kms:Decrypt' only for the production role and deny for all other principals.. The KMS key policy is the primary access control mechanism for a KMS key. Modifying the key policy to allow 'kms:Decrypt' only for the production role and explicitly denying all other principals ensures that only that role can decrypt the RDS instance. This is the most secure and direct method because key policies are evaluated first and can grant or deny access independently of IAM policies.

Answer

Enable key rotation and use a custom key store to isolate the key.

Answer

Create an IAM policy that denies 'kms:Decrypt' to all principals except the production role, and attach it to the key.

Answer

Attach the production IAM role to the RDS instance and use a condition in the IAM role's policy to allow decrypt.

Question 3

A company is using Amazon S3 to store sensitive customer data. They need to ensure that data is encrypted at rest and that the encryption keys are managed by the company, not AWS. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the company to manage the encryption keys themselves while S3 performs the encryption and decryption. The customer provides the key with each request, and AWS does not store the key, satisfying the requirement that keys are managed by the company, not AWS. This is the correct S3 encryption option for customer-managed keys without using AWS KMS.

Answer

Client-side encryption

Answer

SSE-KMS

Answer

SSE-S3

Question 4

A company is designing a data lake on Amazon S3. The data contains personally identifiable information (PII). The security team requires that all data be encrypted at rest and that access to the data is logged for auditing. Additionally, the team wants to ensure that if an object is accidentally deleted, it can be recovered within 30 days. Which combination of S3 features should be enabled?

Accepted Answer

Enable SSE-KMS, S3 Versioning, and S3 Server Access Logs.. SSE-KMS provides encryption at rest with a customer-managed or AWS-managed KMS key, satisfying the encryption requirement with auditability via CloudTrail key usage. S3 Versioning preserves prior object versions so an accidentally deleted object can be restored within 30 days (or indefinitely). S3 Server Access Logs record every request made to the bucket, providing the required access auditing. Together these three features directly map to the three stated requirements: encryption, recoverability, and access logging.

Answer

Enable SSE-C, S3 Lifecycle policies, and CloudWatch Logs.

Answer

Enable SSE-KMS, S3 Versioning with MFA Delete, and S3 Inventory.

Answer

Enable default encryption (SSE-S3), S3 Versioning, and AWS CloudTrail.

Question 5

A company uses AWS KMS to encrypt EBS volumes attached to EC2 instances. The security team wants to ensure that when an EC2 instance is terminated, the associated EBS volume is automatically deleted and the data is unrecoverable. However, the team also needs to retain the volume's data for 90 days for compliance purposes. What is the most secure and cost-effective approach?

Accepted Answer

Before termination, create a snapshot of the volume, copy the snapshot encrypted with a new KMS key, then delete the volume and the original snapshot after 90 days.. Creating a snapshot, copying it with a new KMS key, then deleting the original volume and snapshot after 90 days ensures the data is unrecoverable when the instance is terminated, while retaining a compliant backup. The new KMS key allows independent control over the snapshot's encryption, and deleting the original snapshot after 90 days meets the retention requirement. This approach is secure and cost-effective because snapshots are stored in S3 and only the copied snapshot is retained.

Answer

Use Amazon Data Lifecycle Manager to create a snapshot and delete the volume after termination.

Answer

Disable the KMS key used to encrypt the volume, then terminate the instance.

Answer

Configure the EC2 instance with 'DeleteOnTermination' attribute set to true and enable termination protection.

Question 6

A company uses Amazon RDS for PostgreSQL with encryption at rest enabled using AWS KMS. The security team wants to ensure that database backups (automated snapshots) are also encrypted and that the encryption key can be rotated on demand without re-encrypting the data. Which approach should be taken?

Accepted Answer

Create a new KMS key and modify the RDS instance to use the new key. The existing backup will be re-encrypted with the new key when the instance is modified.. You can create a new KMS key and modify the RDS instance to use the new key. This action re-encrypts the database and its automated snapshots with the new key, providing on-demand key rotation. The re-encryption is performed automatically during the modification. Option A is incorrect because RDS does not allow specifying a separate KMS key for backups; backups use the same key as the instance. Option B is incorrect because disabling the old KMS key would break access to existing backups that are still encrypted with that key. Option C is incorrect because automatic key rotation in KMS does not trigger re-encryption of existing data; it only generates new key material for future encryption operations.

Answer

Use a separate KMS key for backups by enabling 'Copy tags to snapshots' and specifying a different key.

Answer

Disable the old KMS key and enable a new KMS key for the RDS instance. The old backup will remain encrypted with the old key.

Answer

Enable automatic key rotation in KMS and import new key material every 90 days.

Question 7

A company is designing a secure data sharing solution with a third party. The company needs to share sensitive files stored in an S3 bucket with the third party, ensuring that the files are encrypted at rest and in transit, and that the third party can only access specific files. The company also wants to rotate the access credentials every 30 days. Which TWO actions should the company take? (Select TWO.)

Accepted Answer

Configure an S3 bucket policy that denies access unless the request includes a specific KMS key ID.. Options C and E are correct. Option C uses an S3 bucket policy with a condition requiring requests to include a specific KMS key ID, ensuring that only requests using that key can access the objects. This enforces encryption at rest (objects encrypted with that key) and in transit (HTTPS with KMS). Option E grants the third party's AWS account permission to use that KMS key for decrypt operations, allowing them to decrypt the files. Together, they provide encryption key control and the ability to rotate the key or its policy every 30 days. Option A (cross-account IAM role) does not enforce encryption key control and requires the third party to assume a role, but credential rotation is managed via role trust policy, not directly. Option B (S3 Cross-Region Replication) replicates objects but does not enforce key-specific access or encryption at rest in the destination. Option D (presigned URLs) provides time-limited access but does not enforce encryption key control and cannot be easily rotated every 30 days without regenerating URLs.

Answer

Create an IAM role in the company's account that the third party can assume, and attach a policy that grants access to the specific files.

Answer

Use S3 Cross-Region Replication to replicate the files to a bucket in the third party's account.

Answer

Generate presigned URLs for the specific files and email them to the third party.

Question 8

A company uses AWS KMS to encrypt data in S3. The security policy requires that keys be rotated every 12 months. Which type of KMS key supports automatic rotation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS CloudTrail trails for the account to log KMS events.. Options A and B are correct. Enabling CloudTrail trails (A) captures all KMS API calls, including failed attempts to use a disabled key. Configuring a CloudWatch Events rule to send a notification to an SNS topic (B) ensures alerts are sent when such attempts occur. Option D is incorrect because it only triggers on the 'DisableKey' event, which indicates when a key is disabled, not when someone attempts to use a disabled key. Options C and E are incorrect because key rotation and disabling rotation do not help detect attempts to use a disabled key.

Answer

Configure automatic KMS key rotation to generate daily events.

Answer

Create a CloudWatch Events rule that matches the 'DisableKey' event from KMS.

Answer

Disable key rotation to prevent key material changes.

Question 9

A company is migrating its on-premises data warehouse to AWS. The data includes highly sensitive customer financial information. The company has the following requirements: 1) All data must be encrypted at rest using a key that is managed by the company's internal security team. 2) The encryption keys must be rotated every 90 days. 3) The data warehouse must support SQL queries and be highly available across multiple Availability Zones. 4) The solution must minimize the administrative overhead of managing keys. The security team has chosen Amazon Redshift as the data warehouse. They have enabled encryption using AWS KMS with a customer-managed key (CMK). They have set the key rotation period to 90 days using automatic key rotation. However, during a security review, an auditor points out that the key material is still stored in AWS KMS, and the company wants the key material to be stored in a hardware security module (HSM) that they control. Which of the following is the BEST course of action to meet the auditor's requirement while maintaining the other requirements?

Accepted Answer

Create a custom key store in AWS KMS backed by an AWS CloudHSM cluster, and use a KMS key in that custom key store to encrypt the Redshift cluster.. AWS KMS custom key stores allow you to use a KMS key whose key material is stored in an AWS CloudHSM cluster that you control. This meets the auditor's requirement that key material be stored in an HSM the company controls, while still using KMS for key management and integration with Redshift. The other requirements (automatic rotation, Redshift encryption, high availability) are maintained because KMS custom key stores support automatic rotation and Redshift integrates seamlessly with KMS.

Answer

Use AWS CloudHSM directly to generate and manage the encryption keys, and configure Redshift to use those keys via the CloudHSM client.

Answer

Switch to using Amazon S3 server-side encryption with customer-provided keys (SSE-C) and use Redshift Spectrum to query the data.

Answer

Generate the key material on-premises and import it into KMS as a customer-managed key, then use that key for Redshift encryption.

Question 10

A company is migrating sensitive data to Amazon S3. They need to ensure that data is encrypted at rest using an AWS KMS customer managed key (CMK). The security team wants to enforce encryption for all new objects uploaded to an S3 bucket. Which policy should be attached to the bucket?

Accepted Answer

A bucket policy with a condition that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws:kms header. It uses a bucket policy condition that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms (though the option text shows a combined form). This enforces the use of AWS KMS customer managed key (CMK) for server-side encryption. Option A is incorrect because it only allows PutObject if the user has KMS permissions, which does not guarantee the object is encrypted with KMS; the user could still upload without encryption. Option B configures default encryption, but it can be overridden by the uploader; it does not enforce encryption. Option C is about lifecycle policy, not encryption enforcement.

Answer

A bucket policy that allows s3:PutObject only if the user has KMS permissions

Answer

An S3 bucket default encryption setting with AES256

Answer

An S3 Lifecycle policy to transition objects to Glacier after 30 days

Question 11

A company is designing a data protection strategy for Amazon EBS volumes. They want to automate the creation of point-in-time snapshots for all production volumes and retain them for 90 days. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use Amazon Data Lifecycle Manager (DLM) to create a policy that takes snapshots daily and retains them for 90 days. Amazon Data Lifecycle Manager (DLM) is a fully managed, policy-driven service specifically designed to automate the creation, retention, and deletion of EBS snapshots. By defining a lifecycle policy that targets volumes by tag, you can schedule daily snapshots and set a retention rule of 90 days, all without writing any code or managing any infrastructure. This directly satisfies the requirement for point-in-time snapshots with minimal operational overhead.

Answer

Write a script using the AWS CLI that creates snapshots and runs on a schedule via cron on an EC2 instance

Answer

Use an AWS Lambda function triggered by CloudWatch Events to create snapshots and delete old ones

Answer

Use AWS Backup to create a backup plan for EBS volumes with a 90-day retention

Question 12

Refer to the exhibit. A security engineer is troubleshooting why an IAM user (Alice) cannot encrypt data using a KMS key. Alice has full S3 and KMS permissions via an IAM policy. The key policy is shown. Which statement explains the issue?

Accepted Answer

The key policy does not allow the IAM user to use the key for any action. KMS key policies are the primary access control for a KMS key. If the key policy does not explicitly allow Alice (or her account via IAM) to use the key for any action, then even full IAM permissions cannot grant access. The key policy shown must include a statement granting the IAM user or account permission to use the key for Encrypt/Decrypt.

Answer

The key policy is missing a statement to allow the IAM user to use the key via IAM policies

Answer

The IAM user does not have the kms:Encrypt permission in their IAM policy

Answer

The key policy does not include the root account principal

Question 13

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects be encrypted with server-side encryption using customer-provided encryption keys (SSE-C). A developer uploads objects using the AWS SDK but forgets to include the encryption key in the request. What happens to the upload?

Accepted Answer

The upload succeeds but the object is stored without server-side encryption. With SSE-C, the request must include the encryption key. If not provided, the upload succeeds but the object is stored without server-side encryption (i.e., as plaintext). Option C is correct. Option A is wrong because S3 does not deny; B is wrong because no error; D is wrong because default encryption is not applied.

Answer

The upload succeeds and the object is encrypted with the default S3 managed key

Answer

The upload succeeds and the object is encrypted with the bucket's default encryption settings

Answer

The upload fails with a 400 Bad Request error

Question 14

Refer to the exhibit. A security engineer applies the bucket policy to an S3 bucket. A user uploads an object without specifying any encryption header. What happens?

Accepted Answer

The request is denied with an Access Denied error. The bucket policy denies PutObject if the encryption header is not 'aws:kms'. Since the user did not specify any encryption header, the condition 'aws:SecureTransport'? Actually, the policy condition likely checks 's3:x-amz-server-side-encryption' for 'aws:kms'. Without the header, the condition evaluates true (header is not 'aws:kms'), so the request is denied with Access Denied. Option C is correct. Option A is wrong because default encryption is not applied when the policy denies; B is wrong because the policy requires the header to be explicitly set; D is wrong because the policy denies the upload entirely.

Answer

The object is uploaded and encrypted with the bucket's default SSE-S3

Answer

The object is uploaded and encrypted with SSE-KMS

Answer

The object is uploaded without encryption

Question 15

A company uses Amazon DynamoDB with client-side encryption using AWS KMS. The application is experiencing high latency on write operations. Which change is most likely to reduce latency?

Accepted Answer

Cache the data key locally and reuse it for multiple items. Client-side encryption with AWS KMS typically involves calling the KMS GenerateDataKey API to obtain a data key, which is then used to encrypt items locally. Each KMS API call adds network latency. By caching the data key locally and reusing it for multiple items, you eliminate repeated KMS round trips, significantly reducing per-write latency. This is a well-known optimization for client-side encryption patterns.

Answer

Switch to server-side encryption with KMS

Answer

Increase the provisioned write capacity of the table

Answer

Use DynamoDB Accelerator (DAX)