SCS-C02 Data Protection Practice Test 5 — 15 Questions

Question 1

A company is using AWS KMS with a customer managed key for encrypting EBS volumes. The security team wants to ensure that only specific IAM roles can use the key for encryption and decryption. What is the best way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a resource-based policy (key policy) to the KMS key that allows the specific IAM roles.. KMS key policies can directly specify IAM roles as principals, providing fine-grained access to the key. Option B is incorrect: KMS grants are intended for temporary or delegated access, not for permanent role-based control. Option C is incorrect: Service Control Policies (SCPs) apply at the organizational level and cannot grant access to specific IAM roles for a particular KMS key. Option D is incorrect: While IAM policies require the key policy to enable IAM policy access, the most secure and direct method is to use a key policy that explicitly lists the allowed roles, rather than relying on a combination of IAM and key policies.

Answer

Create a KMS grant that allows the roles to use the key.

Answer

Use an SCP to allow only those roles to use the key.

Answer

Use an IAM policy that grants kms:Encrypt and kms:Decrypt to the roles, and ensure the key policy enables IAM policy access.

Question 2

A company is designing a data protection strategy for its Amazon S3 buckets. Which TWO actions can help protect data from accidental deletion or overwrite?

Accepted Answer

Enable MFA Delete on the bucket.. The correct answers are A and D. MFA Delete (A) adds an extra authentication step to prevent unauthorized deletion. Versioning (D) allows recovery of overwritten or deleted objects by preserving previous versions. Options B, C, and E do not protect against accidental deletion: Cross-Region Replication (B) provides disaster recovery, default encryption (C) protects data at rest, and lifecycle policies (E) can actually delete objects.

Answer

Enable Cross-Region Replication.

Answer

Enable default encryption.

Answer

Set a lifecycle policy to expire objects.

Question 3

A company is using AWS Key Management Service (KMS) with a customer managed key. The security team needs to ensure that the key can be rotated automatically every year. Which TWO steps are required?

Accepted Answer

Enable automatic key rotation in the KMS console or API.. The correct answers are B and E. Option B: Automatic key rotation can be enabled in the KMS console or API for customer managed keys. Option E: The key must be a customer managed key (CMK) because automatic rotation is not available for AWS managed keys. Option A is incorrect because CloudTrail is not required for rotation. Option C is incorrect because key material must be generated by AWS KMS (not imported) for automatic rotation, but this is a prerequisite, not a separate step. Option D is incorrect because the KMS service principal does not need permission to rotate the key.

Answer

Enable AWS CloudTrail for the KMS key.

Answer

Ensure the key material is generated by AWS KMS, not imported.

Answer

Grant the KMS service principal permission to rotate the key.

Question 4

A company needs to protect data in transit between an on-premises data center and AWS. Which THREE services can be used to encrypt data in transit?

Accepted Answer

HTTPS. The correct answers are C (HTTPS), D (AWS Site-to-Site VPN), and E (AWS Certificate Manager (ACM)). HTTPS encrypts web traffic using TLS. AWS Site-to-Site VPN creates an IPsec VPN tunnel to encrypt all traffic between on-premises and AWS. AWS Certificate Manager (ACM) provisions and manages TLS certificates used to encrypt data in transit. Option A (AWS KMS) manages encryption keys for data at rest, not in transit. Option B (AWS Shield) protects against DDoS attacks, not data encryption.

Answer

AWS Key Management Service (KMS)

Answer

AWS Shield

Question 5

A company is storing sensitive customer data in Amazon S3. The security team requires that all data be encrypted at rest using a key that is rotated automatically every year. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use SSE-S3. (SSE-S3) is correct because it uses Amazon S3-managed keys that are automatically rotated by AWS every year, meeting the encryption and rotation requirements with zero operational overhead. Option A (SSE-C) is wrong because the customer manages the keys and must handle rotation manually or not at all. Option C (SSE-KMS) can use automatic key rotation, but it requires creating a KMS key and managing permissions, adding more overhead than SSE-S3. Option D (client-side encryption) requires the customer to implement encryption logic and key management, which adds significant operational complexity.

Answer

Use SSE-C with an AWS-managed key

Answer

Use SSE-KMS with automatic key rotation

Answer

Use client-side encryption with a custom key

Question 6

A company uses AWS KMS to encrypt data in Amazon RDS. The security team discovers that a developer accidentally deleted a customer master key (CMK) used for RDS encryption. What is the impact on the RDS instances that were encrypted with that key?

Accepted Answer

The RDS instances will become inaccessible and data will be lost. When a Customer Master Key (CMK) is deleted in AWS KMS, the encrypted RDS instances become permanently inaccessible and the data is lost. AWS KMS enforces a waiting period (default 7-30 days) before deletion, but once the key is deleted, decryption is impossible. Option B is incorrect because although key deletion is reversible during the waiting period, after deletion the data is lost. Option C is incorrect because automatic re-encryption is not possible without the original key. Option D is incorrect because the instances cannot operate normally without access to the encryption key.

Answer

The key deletion can be reversed within 30 days

Answer

The RDS instances will be automatically re-encrypted with a new key

Answer

The RDS instances will continue to operate normally

Question 7

A company wants to ensure that all data transferred between its on-premises data center and AWS is encrypted in transit. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN. This service provides an encrypted tunnel between on-premises networks and AWS VPCs using IPsec. Option A: Amazon CloudFront is a content delivery network (CDN) and does not provide site-to-site encryption. Option B: AWS Transit Gateway is a network transit hub for interconnecting VPCs and on-premises networks but does not itself provide encryption; it can be used with VPN or Direct Connect. Option C: AWS Direct Connect provides a dedicated private connection but does not encrypt traffic by default; encryption can be added with IPsec or VPN.

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 8

A company uses AWS KMS to encrypt data in Amazon S3. The security team needs to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. What is the most secure way to enforce this restriction?

Accepted Answer

Set a KMS key policy that grants kms:Decrypt only to the IAM role. By setting a KMS key policy that explicitly grants kms:Decrypt only to the specific IAM role, you enforce that only that role can use the key for decryption, even if other IAM policies allow access. This is the most secure because KMS key policies provide resource-based control directly on the key. Option A is wrong because an S3 bucket policy controls access to S3 objects but not the KMS decryption operation; it cannot prevent someone with KMS decrypt permissions from using the key. Option C is wrong because S3 access logs only record actions, they do not enforce permissions. Option D is wrong because an IAM policy attached to the role grants kms:Decrypt, but that alone does not prevent other roles from also getting the same permission via other policies; the key policy is the authoritative control.

Answer

Apply an S3 bucket policy that denies all principals except the IAM role

Answer

Use S3 access logs to monitor unauthorized decryption attempts

Answer

Attach an IAM policy to the role granting kms:Decrypt permission

Question 9

A company needs to share an encrypted Amazon Machine Image (AMI) with another AWS account. The AMI was encrypted using a customer managed key (CMK) in AWS KMS. What steps are required to allow the target account to launch an EC2 instance from the shared AMI?

Accepted Answer

Modify the AMI launch permissions to include the target account and add the target account to the KMS key policy. Both the AMI launch permissions and the KMS key policy must grant access to the target account. Option B is wrong because copying the AMI does not automatically share the KMS key; the key policy still needs to be updated. Option C is wrong because modifying only AMI launch permissions does not grant the target account permission to use the KMS key for decryption. Option D is wrong because adding the target account to the KMS key policy alone does not grant access to the AMI; the AMI launch permissions must also be modified.

Answer

Copy the AMI and share the copy; the key is automatically shared

Answer

Only modify the AMI launch permissions to include the target account

Answer

Only add the target account to the KMS key policy

Question 10

A company stores data in Amazon S3 and wants to ensure that objects are encrypted at rest. The security team decides to use server-side encryption with AWS KMS (SSE-KMS). Which additional benefit does SSE-KMS provide over SSE-S3?

Accepted Answer

Separate permissions for key usage and audit of key usage. SSE-KMS provides separate permissions for key usage and allows auditing of key usage via AWS CloudTrail. Option A is incorrect because both SSE-S3 and SSE-KMS use the same AES-256 encryption algorithm for encryption and decryption. Option B is incorrect because SSE-KMS incurs additional costs for KMS API calls, making it more expensive per object than SSE-S3. Option D is incorrect because both options use the same strong encryption algorithm (AES-256).

Answer

Faster encryption and decryption

Answer

Lower cost per object

Answer

Stronger encryption algorithm

Question 11

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team needs to ensure that automated backups are also encrypted. How can this be achieved?

Accepted Answer

Enable encryption at rest on the RDS instance; backups are automatically encrypted. Enabling encryption at rest on the RDS instance automatically encrypts backups. Option A is incorrect because manual encryption of backups is not required and is not practical. Option C is incorrect because RDS does not support Copy-on-Write for encrypting backups. Option D is incorrect because simply storing backups in an encrypted S3 bucket does not encrypt the backup files unless they are encrypted at rest by RDS.

Answer

Manually encrypt each backup using AWS KMS before storing in S3

Answer

Use RDS Copy-on-Write to encrypt backups

Answer

Create an encrypted S3 bucket and store backups there

Question 12

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team needs to ensure high availability and durability of the keys. Which architecture should be recommended?

Accepted Answer

Deploy a CloudHSM cluster with at least two HSMs in different Availability Zones. Deploying a CloudHSM cluster with at least two HSMs in different Availability Zones ensures high availability and durability by eliminating a single point of failure and providing redundancy across AZs. Option A is incorrect because AWS KMS is a different service and does not provide the same hardware-based key generation and storage as CloudHSM. Option B is incorrect because a single CloudHSM instance in one AZ is a single point of failure. Option C is incorrect because CloudHSM does not automatically replicate data across regions; cross-region replication requires manual backup and restore processes.

Answer

Use AWS KMS instead of CloudHSM for better durability

Answer

Deploy a single CloudHSM instance in one Availability Zone

Answer

Deploy CloudHSM in two AWS Regions with automatic replication

Question 13

A company is designing a data lake on Amazon S3 and needs to encrypt data at rest. The compliance team requires that the encryption keys be managed by the company and not by AWS. Which encryption option should be used?

Accepted Answer

SSE-C. (SSE-C) is correct because SSE-C allows the customer to provide their own encryption keys, meeting the compliance requirement that keys be managed by the company and not by AWS. Option B (SSE-S3) is incorrect because AWS manages the keys. Option D (SSE-KMS) is incorrect because even with customer-managed keys, AWS KMS stores and manages the keys. Option C (client-side encryption) is not server-side encryption and would require the customer to manage encryption before upload, but the question specifically asks for encryption at rest on S3, and server-side options are appropriate; SSE-C is the only server-side option where AWS does not manage the keys.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 14

A company is implementing a data protection strategy for Amazon S3. Which TWO actions should be taken to protect data from accidental deletion or overwrite?

Accepted Answer

Enable MFA Delete on the bucket. Options B and D are correct. Enable S3 Versioning to preserve previous versions of objects, and enable MFA Delete to require multi-factor authentication for destructive operations. Option A is wrong because cross-region replication does not protect against accidental deletion in the source bucket; it only copies objects to another region. Option C is wrong because a bucket policy that denies s3:DeleteObject alone does not prevent overwrites (which use s3:PutObject) and may not cover all deletion scenarios; MFA Delete and versioning are more comprehensive. Option E is wrong because default encryption only encrypts data at rest, it does not prevent deletion or overwrite.

Answer

Enable cross-region replication

Answer

Apply a bucket policy that denies s3:DeleteObject

Answer

Enable default encryption on the bucket

Question 15

A company wants to protect sensitive data in Amazon S3 from unauthorized access. Which TWO AWS services can be used to detect and alert on suspicious access patterns?

Accepted Answer

AWS CloudTrail. Options A and E are correct. Amazon Macie uses machine learning to discover, classify, and protect sensitive data in S3, and it can alert on suspicious access patterns. AWS CloudTrail logs all API calls to S3, which can be analyzed to detect unauthorized access. Option B (AWS Config) is incorrect because it assesses compliance and tracks configuration changes but does not focus on data access patterns. Option C (Amazon CloudWatch Logs) is incorrect because while it can store S3 access logs, it does not inherently analyze for suspicious patterns without additional services like CloudWatch Logs Insights. Option D (Amazon GuardDuty) is incorrect because although it detects threats across AWS accounts, it is not specifically for S3 data access patterns; its primary focus is on network and account-level threats.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty