SCS-C02 Data Protection Practice Test 5 — 15 Questions

Question 1

A security engineer is configuring a new AWS KMS customer managed key. Which THREE of the following are required components of a KMS key policy?

Accepted Answer

A statement that grants key usage permissions to specific IAM users or roles. Option A is correct because a KMS key policy must contain a statement granting key usage permissions (such as kms:Encrypt, kms:Decrypt, kms:GenerateDataKey) to specific IAM users or roles so they can actually use the key for cryptographic operations. Option C is correct because the policy must also include a statement granting key administration permissions (such as kms:Create*, kms:Describe*, kms:Enable*, kms:PutKeyPolicy, kms:ScheduleKeyDeletion) to specific IAM roles, separating administrative control from usage. Option D is correct because AWS requires the key policy to include a statement that gives the AWS account (root) full access to the key, which serves as the default enabling mechanism and prevents the key from becoming unmanageable; without it, the key can be locked out. Option B is not a required component because the key alias is a separate resource (an alias) created via kms:CreateAlias and is not defined inside the key policy. Option E is not required because automatic key rotation is an optional key setting configured via kms:EnableKeyRotation, not a mandatory statement in the key policy.

Answer

A statement that defines the key alias

Answer

A statement that enables automatic key rotation

Question 2

A financial services company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application processes credit card numbers and stores them in an Amazon RDS for PostgreSQL database. The database is encrypted at rest using AWS KMS. The security team is concerned about data in transit between the ALB and EC2 instances, and between EC2 and RDS. They also want to ensure that the application never logs the full credit card number. The current setup: ALB terminates SSL using a certificate from AWS Certificate Manager (ACM). EC2 instances are in a private subnet. RDS is in a private subnet. The application logs to CloudWatch Logs. The security team reviews the logs and finds full credit card numbers in the logs. Which of the following actions should the security engineer take to address the data protection issues?

Accepted Answer

Modify the application to use TLS when connecting to RDS and update the application code to mask or truncate credit card numbers before logging. The application must use TLS when connecting to RDS to protect data in transit, and the code must mask or truncate credit card numbers before logging to prevent sensitive data from appearing in CloudWatch Logs. This addresses both the in-transit encryption between EC2 and RDS and the logging of full credit card numbers.

Answer

Create a CloudWatch Logs subscription filter to redact credit card numbers from the logs after they are sent to CloudWatch

Answer

Enable RDS encryption with a new KMS key and enforce that all connections to RDS use SSL

Answer

Enable encryption in transit between the ALB and EC2 by using HTTPS listeners and configure the ALB to re-encrypt traffic to EC2 using a self-signed certificate on each instance

Question 3

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific IAM role can decrypt objects. What is the MOST secure way to achieve this?

Accepted Answer

Use a customer managed KMS key with a key policy that grants kms:Decrypt only to the specific IAM role, and configure the S3 bucket policy to allow only that role to access the bucket.. The most secure approach because it uses a customer managed KMS key with a key policy that grants kms:Decrypt only to the specific IAM role. Combined with an S3 bucket policy that restricts bucket access to that same role, this ensures that only the designated role can both access the S3 objects and decrypt them. Option B is incorrect because automatic key rotation does not control access permissions. Option C is incorrect because the S3 bucket policy alone cannot control decryption permissions; the KMS key policy is also required. Option D is incorrect because using an AWS managed key and S3 default encryption does not restrict decryption to a specific IAM role.

Answer

Enable automatic key rotation in KMS and assign the key to the IAM role.

Answer

Configure an S3 bucket policy that denies all users except the specific IAM role.

Answer

Use S3 default encryption with an AWS managed key and trust the IAM role.

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that if a KMS key is disabled, all subsequent attempts to decrypt data encrypted with that key fail. What is the BEST way to achieve this?

Accepted Answer

Disable the KMS key.. Disabling a KMS key immediately prevents use of that key for decryption, so all subsequent decryption attempts fail. Option A is wrong because rotating a key does not affect the existing key's ability to decrypt data encrypted with it. Option B is wrong because revoking grants only removes permissions granted via grants; it does not affect the key policy or direct access, so decryption may still succeed. Option D is wrong because deleting a key is irreversible and can cause permanent data loss; disabling is sufficient and safer.

Answer

Rotate the KMS key immediately.

Answer

Revoke all grants associated with the KMS key.

Answer

Delete the KMS key.

Question 5

Refer to the exhibit. An IAM policy allows kms:Decrypt on a specific KMS key only when the encryption context includes department=finance. A user attempts to decrypt an S3 object that was encrypted with the same KMS key but with encryption context department=hr. Will the decryption succeed?

Accepted Answer

No, because the encryption context does not match.. The IAM policy requires the encryption context to include department=finance for kms:Decrypt. Since the object was encrypted with department=hr, the encryption context does not match, and the decryption fails. Option B is incorrect because the key policy is not the issue; the IAM policy restricts based on encryption context. Option C is incorrect because while the user has kms:Decrypt permission on the key, the condition on that permission is not satisfied. Option D is incorrect because kms:DescribeKey permission is irrelevant to decryption; the condition on kms:Decrypt is not met.

Answer

No, because the key policy does not allow the user to decrypt.

Answer

Yes, because the user has kms:Decrypt permission on the key.

Answer

Yes, if the user also has kms:DescribeKey permission.

Question 6

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes credit card numbers and must comply with PCI DSS. The security team requires that all credit card numbers be encrypted at rest and in transit. The application stores the encrypted credit card numbers in Amazon RDS for MySQL. The RDS instance is encrypted at rest using AWS KMS. The application decrypts the credit card numbers after retrieval using a KMS key. The security team has noticed that some credit card numbers are being logged in plaintext in Amazon CloudWatch Logs by the application. The developers claim they are not logging the decrypted values. What is the MOST likely cause and solution?

Accepted Answer

Disable RDS audit logging or ensure that the query logs do not contain sensitive data.. The most likely cause is that RDS audit logging or query logging is capturing the plaintext credit card numbers when the application decrypts them and executes queries. The solution is to disable such logging or ensure that logs do not contain sensitive data. This addresses the root cause without impacting application functionality.

Answer

Use AWS KMS key policies to prevent the application from decrypting the credit card numbers.

Answer

Modify the application code to encrypt the credit card numbers before logging.

Answer

Enable SSL/TLS encryption for the connection between the application and RDS.

Question 7

A company is using Amazon S3 to store sensitive documents. The security team has implemented a bucket policy that denies access unless the request uses HTTPS. However, a security audit reveals that some objects were accessed over HTTP. The bucket policy is as follows: {"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::example-bucket/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. The team also enabled S3 Block Public Access at the account level. What is the MOST likely reason that HTTP access was still possible?

Accepted Answer

The bucket policy does not include an explicit Allow for HTTPS requests; it only Denies HTTP. Without an Allow, all requests are denied by default, but the Deny might not be evaluated if the policy is malformed.. The bucket policy condition uses the string 'false' instead of the required boolean false, making the Deny ineffective because the condition cannot evaluate true. When requests are made, if an identity-based IAM policy explicitly allows access, the default implicit deny from the bucket policy is overridden, and HTTP access is permitted. This is captured by option D, which highlights that the malformed policy may not evaluate the Deny, allowing access. Pre-signed URLs (option C) do not bypass bucket policies; S3 Block Public Access (option A) does not enforce HTTPS; and Access Points (option B) still evaluate bucket policies.

Answer

S3 Block Public Access only blocks public access, not all HTTP access.

Answer

The requests were made through an S3 Access Point that has its own policy allowing HTTP.

Answer

The requests were made using pre-signed URLs that bypass bucket policies.

Question 8

A company is migrating its on-premises file server to Amazon EFS. The data includes sensitive financial records. The security team requires encryption at rest and in transit. The team plans to mount the EFS file system on EC2 instances using the NFS client. They have enabled encryption at rest on the EFS file system. However, they are unsure how to enforce encryption in transit. What should they do to ensure all data transferred between the EC2 instance and EFS is encrypted?

Accepted Answer

Mount the EFS file system using the `mount -t nfs4 -o tls` command on the EC2 instance.. To enforce encryption in transit for EFS, the NFS client must be mounted with TLS. The correct mount option is `-o tls` (or `-o tls,port=2049`), which uses the EFS mount helper to establish a TLS tunnel for NFS traffic. This ensures that all data transferred between the EC2 instance and EFS is encrypted. Enabling encryption at rest on the file system does not automatically encrypt data in transit, so the mount option is required.

Answer

Enable encryption in transit in the EFS file system policy and rely on the default NFS client behavior.

Answer

Set up a VPN connection between the VPC and the on-premises network to encrypt all traffic.

Answer

Use AWS Certificate Manager to issue a certificate for the EFS file system.

Question 9

A company runs a workload on Amazon EC2 that needs to access an Amazon S3 bucket to store sensitive data. The security team wants to ensure that the data is encrypted at rest in S3 without requiring any changes to the application. The application currently uses the AWS SDK to upload objects. Which solution meets the requirement with the LEAST operational overhead?

Accepted Answer

Enable S3 default encryption on the bucket using SSE-S3.. Enabling S3 default encryption with SSE-S3 (AES-256) encrypts all objects at rest automatically without any application changes. The AWS SDK uploads continue to work unchanged because S3 handles encryption server-side. This meets the requirement with the least operational overhead — no code changes, no key management, no bucket policy modifications.

Answer

Configure an S3 bucket policy that denies uploads without encryption.

Answer

Modify the application to use client-side encryption with KMS.

Answer

Use a KMS key policy to require encryption for the bucket.

Question 10

A company uses AWS KMS to encrypt data in Amazon DynamoDB. The table has a TTL attribute that triggers automatic deletion of expired items. The security team is concerned that deleted items may still be recoverable. What should the team do to ensure that deleted items are cryptographically erased and cannot be recovered?

Accepted Answer

Delete the KMS customer master key (CMK) used to encrypt the table after verifying no other data depends on it.. Cryptographic erasure requires destroying the encryption key so that any remaining ciphertext, including backups or residual data, becomes permanently undecryptable. Deleting the KMS customer master key (CMK) used to encrypt the DynamoDB table ensures that all data encrypted under that key, including TTL-deleted items that may persist in backups or storage media, can never be recovered. This is the only option that provides true cryptographic erasure.

Answer

Disable the KMS key to prevent decryption of deleted items.

Answer

Configure DynamoDB TTL to encrypt the items before deletion.

Answer

Create a backup of the table and then delete the table.

Question 11

A financial services company stores sensitive customer data in Amazon RDS for MySQL. The compliance team mandates that all database backups must be encrypted at rest. The current configuration uses a customer managed KMS key for encryption. However, during a recent audit, it was discovered that some automated backups are not encrypted. What is the MOST likely cause?

Accepted Answer

The DB instance was created without enabling encryption at rest.. Automated backups inherit the encryption setting from the DB instance. If the DB instance was created without encryption at rest, its automated backups will not be encrypted, even if a KMS key is available. Option A is incorrect because disabling the KMS key would cause encryption failures, but the backups would still be encrypted with that key until it is disabled; the issue is that backups are not encrypted at all. Option B is incorrect because automated backups are stored in S3 buckets managed by AWS, but the encryption is applied at the DB instance level, not the S3 bucket. Option C is incorrect because there is no separate toggle for backup encryption; it is automatically inherited from the DB instance's encryption setting.

Answer

The KMS key used for encryption was disabled during the backup window.

Answer

The automated backups are stored in an unencrypted S3 bucket.

Answer

The automated backup encryption setting was turned off separately.

Question 12

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only users from a specific AWS account can decrypt objects. Which TWO steps should be taken to achieve this?

Accepted Answer

Configure the KMS key policy to allow the target AWS account to use the key for decrypt.. Option B is correct because the KMS key policy is the primary resource-based access control for a KMS key, and explicitly allowing the target AWS account (e.g., via Principal arn:aws:iam::TARGET-ACCOUNT:root) to call kms:Decrypt grants that account the ability to use the key for decryption. Option D is correct because even when the key policy delegates access to the target account, IAM principals in that account still need an identity-based IAM policy granting kms:Decrypt on the key's ARN to actually perform the decryption. Together, the key policy and the IAM policy satisfy KMS's requirement that both the key policy and IAM permissions allow the action. Option A is not appropriate because S3 bucket policies govern S3 object-level actions, not KMS kms:Decrypt calls, so a bucket policy cannot control who may decrypt with the KMS key. Option C is unnecessary and does not by itself restrict decryption to a specific account, since permissions are governed by key and IAM policies, not by key cardinality. Option E is irrelevant because enabling S3 default encryption only sets the default encryption behavior for new objects and does not grant or restrict kms:Decrypt permissions.

Answer

Add a bucket policy that denies decrypt for all users except those from the target account.

Answer

Use a different KMS key for each object to isolate permissions.

Answer

Enable S3 default encryption with the KMS key.

Question 13

A healthcare company stores sensitive patient data in Amazon S3. The security team has implemented a data protection strategy that includes S3 default encryption using SSE-KMS with a customer managed key. They also use S3 Object Lock to prevent deletion. Recently, an administrator accidentally deleted the KMS key used for encryption. As a result, all objects in the bucket are now inaccessible. The company has a backup of the key material but does not have the original key ID. Which action should the team take to restore access to the data?

Accepted Answer

Import the key material into a new KMS key and re-encrypt all objects using S3 Batch Operations.. When a KMS key is deleted, the key material is destroyed and cannot be recovered. The only way to restore access to data encrypted with that key is to import the backed-up key material into a new KMS key and then re-encrypt the objects with the new key. S3 Batch Operations can efficiently re-encrypt all objects at scale using the new key.

Answer

Use the backup key material directly in an application to decrypt objects without KMS.

Answer

Create a new KMS key with the same key ID using the backup material.

Answer

Restore the deleted KMS key from the CloudHSM backup.

Question 14

A security engineer is designing a data encryption solution for a multi-region application that uses Amazon S3. The solution must use envelope encryption with a key hierarchy that allows the application to encrypt data locally using a data key, while the data key is protected by a master key stored in AWS KMS. The application should be able to decrypt data even if connectivity to AWS KMS is temporarily lost. Which approach meets these requirements?

Accepted Answer

Use KMS GenerateDataKey to obtain a plaintext data key and encrypted data key. Cache the plaintext key in memory; for decryption, use the cached key. If cache miss, call KMS Decrypt.. The requirement is to use envelope encryption with a data key protected by a KMS master key, and to decrypt even if KMS is temporarily unreachable. Option D achieves this by caching the plaintext data key in memory, so decryption can occur without calling KMS. If the cache is missed, it falls back to KMS Decrypt. This meets the availability requirement while maintaining the key hierarchy.

Answer

Use the KMS GenerateDataKey API to get a plaintext data key and encrypted data key. Store both; for decryption, call KMS Decrypt to get the plaintext key.

Answer

Use KMS GenerateDataKeyWithoutPlaintext to get only the encrypted data key. Store it; for decryption, call KMS Decrypt.

Answer

Use an AWS managed key to encrypt data directly without a data key.

Question 15

A company uses AWS CloudTrail to log data events for S3 buckets. They notice that some S3 object-level API calls are not being logged. Which configuration could be the cause?

Accepted Answer

The trail is not configured to log data events for the S3 bucket.. CloudTrail trails must be explicitly configured to log data events for S3 buckets. Data events are high-volume operations (e.g., GetObject, PutObject, DeleteObject) and are not captured by default. If the trail is not configured to log data events for the specific S3 bucket, those object-level API calls will not appear in the CloudTrail logs.

Answer

The trail is configured to log management events only.

Answer

The trail is using a CloudWatch Logs log group for delivery.

Answer

The trail is configured to log read events only.