SCS-C02 Data Protection Practice Test 6 — 15 Questions

Question 1

Which THREE actions are required to enforce encryption in transit for an Amazon S3 bucket? (Choose 3.)

Accepted Answer

Add a bucket policy that denies requests with aws:SecureTransport set to false.. Option A is correct because a bucket policy with a Deny effect conditioned on "aws:SecureTransport": "false" explicitly rejects any request made over plain HTTP, which is the standard mechanism for enforcing encryption in transit on an S3 bucket. Option B is correct because an Allow statement that matches requests where aws:SecureTransport is false would grant access over unencrypted HTTP; since an explicit Allow can override or coexist with Deny logic in ways that permit non-TLS access, the policy must not contain such an Allow for the enforcement to be airtight. Option C is correct because encryption in transit for S3 is provided by TLS, so clients must actually use HTTPS endpoints (e.g., https://bucket.s3.region.amazonaws.com) for the data to be encrypted on the wire. Option D is not correct because default encryption (SSE-S3, SSE-KMS, or SSE-C) protects data at rest, not data in transit. Option E is not correct because an IAM policy restricting access controls who can call S3 APIs but does not by itself require TLS or block HTTP requests.

Answer

Enable default encryption on the bucket.

Answer

Use an IAM policy to restrict access to the bucket.

Question 2

A company needs to encrypt data at rest in Amazon S3 using customer-provided encryption keys. The keys must be stored securely and rotated automatically every 90 days. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with a customer-managed key (CMK) and enable automatic key rotation.. None of the options fully satisfy all requirements. Option B (AWS KMS with a customer-managed key) allows customer-provided keys and automatic key rotation, but KMS automatic rotation is annual, not every 90 days. Option A (SSE-C) does not provide automatic key rotation. Option C (SSE-S3) uses Amazon-managed keys, not customer-provided. Option D (AWS CloudHSM) requires custom scripting for rotation, not automatic.

Answer

Use SSE-C and upload new keys to S3 every 90 days.

Answer

Use SSE-S3 and enable automatic key rotation in the S3 bucket properties.

Answer

Use AWS CloudHSM and generate a new key every 90 days via a custom script.

Question 3

A company uses Amazon S3 to store sensitive documents. The security team wants to ensure that all objects are encrypted at rest using server-side encryption. Additionally, any attempt to upload an unencrypted object must be denied. What should the security team do?

Accepted Answer

Add an S3 bucket policy that denies PutObject if the object is not encrypted using SSE-S3 or SSE-KMS.. The correct approach is to add an S3 bucket policy that explicitly denies PutObject requests unless the object is encrypted with SSE-S3 or SSE-KMS. This policy uses the condition key 's3:x-amz-server-side-encryption' to enforce encryption at the time of upload, ensuring that any attempt to upload an unencrypted object is denied. This meets the requirement of denying unencrypted uploads while allowing encrypted ones.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Answer

Add an S3 bucket policy that requires encryption using the 's3:x-amz-server-side-encryption' condition key.

Answer

Create an AWS Config rule to detect unencrypted objects and trigger a Lambda function to encrypt them.

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. The security team notices that a KMS key has been deleted accidentally, causing data loss. The company wants to implement a solution to prevent accidental key deletion and enable recovery. What should the security team do?

Accepted Answer

Create a multi-Region key and enable automatic key rotation.. Creating a multi-Region key replicates the key material to another AWS Region, providing a backup that can be used if the primary key is accidentally deleted. Enabling automatic key rotation further enhances security by regularly rotating the backing keys, but it does not prevent deletion. However, the multi-Region key approach allows recovery from accidental deletion by using the replica in another Region. Option A is incorrect because disabling the key only prevents its use, not its deletion; the deletion waiting period allows recovery only if the deletion is canceled within the waiting period. Option B is incorrect because automatic key rotation does not prevent deletion; it only creates new cryptographic material. Option D is incorrect because AWS CloudHSM does not directly integrate with S3 server-side encryption using KMS (SSE-KMS) for automatic encryption; it requires custom applications.

Answer

Enable the key's 'Disable key' option and set a deletion waiting period of 7 days.

Answer

Enable automatic key rotation for the KMS key.

Answer

Use AWS CloudHSM to store the key material and create a backup in another Region.

Question 5

A company's security policy requires that all data stored in Amazon S3 be encrypted using envelope encryption with a key hierarchy. The master key must be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated. Which solution should the company implement?

Accepted Answer

Use AWS KMS with a custom key store backed by AWS CloudHSM.. AWS KMS custom key store backed by AWS CloudHSM allows you to use a KMS key that is backed by a FIPS 140-2 Level 3 validated HSM. This meets the requirement for envelope encryption with a key hierarchy where the master key is stored in an HSM. The custom key store integrates with KMS, so you can use KMS APIs for envelope encryption while the master key never leaves the HSM.

Answer

Use AWS KMS with the default KMS key store.

Answer

Use Amazon S3 with SSE-S3 and enable default encryption.

Answer

Use AWS CloudHSM to generate a master key and implement envelope encryption in the application.

Question 6

A company needs to encrypt data at rest for an Amazon RDS for Oracle database. The database is deployed in a Multi-AZ configuration. The company also wants to encrypt automated backups and snapshots. Which TWO steps should the security team take?

Accepted Answer

Enable encryption at rest when launching the RDS instance.. Option A is correct because Amazon RDS encryption at rest must be enabled at the moment the DB instance is created; selecting encryption during launch applies AES-256 encryption to the underlying storage, and for a Multi-AZ deployment the same encryption is applied to the standby replica. Option C is correct because when you enable encryption at rest on an RDS instance, the automated backups, read replicas, and snapshots associated with that encrypted instance are automatically encrypted using the same AWS KMS customer master key, so no separate backup-encryption step is required. Option B is incorrect because an existing unencrypted RDS DB instance cannot be modified in place to enable encryption; you must create a new encrypted instance and migrate data (for example, via a snapshot restore into an encrypted instance). Option D is incorrect for the same reason: RDS does not support enabling encryption at rest through a modify operation on an existing instance. Option E is incorrect because the KMS key must be chosen when encryption is enabled at creation time; you cannot attach a KMS key to an already-launched unencrypted instance.

Answer

Modify the DB instance to enable encryption after creation.

Answer

Enable encryption at rest on the existing RDS instance via a modification.

Answer

Specify a KMS key after the instance is launched.

Question 7

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. The engineer attempts to upload a file using the AWS CLI without specifying any encryption. What is the outcome?

Accepted Answer

The upload succeeds because default encryption on the bucket will encrypt the object with SSE-S3.. The bucket policy includes a Deny effect with a condition 'StringNotEquals': {'s3:x-amz-server-side-encryption': 'aws:kms'}. This condition denies requests only when the x-amz-server-side-encryption header is present in the request and its value is not 'aws:kms'. If the header is absent (as when the user does not specify encryption), the condition evaluates to false, meaning the Deny rule does not apply. Therefore, the upload is not denied by this policy. Since new S3 buckets have default encryption enabled with SSE-S3, the object will be encrypted with SSE-S3, and the upload succeeds. Option A is incorrect because the policy does not deny all requests; it only denies those that include a supported but non-matching encryption header. Option C is incorrect because it assumes the Deny applies when the header is absent, which is not the case for 'StringNotEquals' (without 'IfExists'). Option D is similar to B but B is the more precise statement.

Answer

The upload fails because the policy denies all PutObject requests.

Answer

The upload fails because the policy denies PutObject when encryption is not SSE-KMS.

Answer

The upload succeeds because the object is encrypted with SSE-S3 by default.

Question 8

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. They must manage the encryption keys themselves and rotate them annually. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys and manage rotation. SSE-S3 uses AWS-managed keys (no customer control). SSE-KMS uses KMS keys but AWS manages rotation unless using customer-managed keys with automatic rotation. Option C is correct because SSE-C gives full control over key management and rotation.

Answer

SSE-S3

Answer

SSE-KMS with AWS managed key

Answer

Client-side encryption

Question 9

A company wants to protect data in transit between an on-premises data center and AWS over the internet. Which AWS service should they use to create a dedicated, encrypted connection?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN provides an encrypted tunnel over the internet between on-premises and AWS. AWS Direct Connect provides a dedicated connection but is not encrypted by default; IPsec can be added. AWS Transit Gateway is a network transit hub, not a connection type. AWS Client VPN is for individual clients. Option C is correct.

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Answer

AWS Client VPN

Question 10

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

Accepted Answer

The bucket policy does not include the aws:SourceVpce condition.. The bucket policy explicitly allows access only from the VPC endpoint, which requires the aws:SourceVpce condition key to identify that endpoint. Without this condition, the policy does not grant access to requests originating from the VPC endpoint, even if the IAM role has s3:GetObject permissions. Since the instance receives AccessDenied, the missing condition is the most likely cause. The IAM role permissions are already granted, and security groups do not filter S3 traffic through a VPC endpoint (which uses prefix lists and is stateful).

Answer

The IAM role does not have sufficient permissions.

Answer

The VPC endpoint policy is blocking the request.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Question 11

A security engineer is designing a data protection strategy for Amazon RDS for PostgreSQL. The database contains sensitive personal information. Which TWO actions should the engineer take to protect the data at rest? (Choose TWO.)

Accepted Answer

Enable encryption at rest for the RDS instance using AWS KMS.. Option A is correct because enabling encryption at rest for the RDS instance using AWS KMS is the primary mechanism to protect the underlying storage (including the DB instance's storage volumes) for sensitive data in Amazon RDS for PostgreSQL. Option D is correct because automated backups are stored separately from the DB instance storage, and enabling encryption for automated backups using the same KMS key ensures those backup snapshots are also protected at rest. Option B is incorrect because SSL/TLS protects data in transit, not data at rest. Option C is incorrect because deleting automated backups after 30 days is a retention policy and does not encrypt or protect data at rest. Option E is incorrect because deletion protection only prevents accidental deletion of the DB instance and does not provide encryption at rest.

Answer

Enable SSL/TLS for connections to the database.

Answer

Delete automated backups after 30 days.

Answer

Enable deletion protection for the RDS instance.

Question 12

A company uses AWS KMS to encrypt sensitive data. The security team wants to ensure that KMS keys are not used by unauthorized principals. Which TWO measures should be implemented? (Choose TWO.)

Accepted Answer

Define a key policy that grants kms:Encrypt and kms:Decrypt only to specific IAM roles.. Using key policies to restrict which IAM roles can use the key (Option A) and enabling automatic key rotation to limit the window of compromise (Option E) are effective. Granting broad access (Option D) is not recommended. Deleting unused keys (Option B) does not prevent unauthorized use of remaining keys. Creating aliases (Option C) does not control access.

Answer

Delete any KMS keys that are not used for more than 90 days.

Answer

Create aliases for frequently used keys.

Answer

Grant kms:* permissions to all IAM users in the account.

Question 13

A company is designing a data protection solution for Amazon S3. They need to ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which THREE steps should they take? (Choose THREE.)

Accepted Answer

Enable default encryption on the S3 bucket with SSE-S3 or SSE-KMS.. To ensure all objects are encrypted at rest and unencrypted uploads are denied, enable default encryption (Option C) and add a bucket policy that denies s3:PutObject without the encryption header (Option D). Additionally, enabling S3 Block Public Access (Option E) prevents accidental public exposure of data, complementing the encryption strategy. These three steps together provide a robust data protection solution for S3.

Answer

Enable versioning on the bucket.

Answer

Enable MFA Delete on the bucket.

Question 14

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. A developer attempts to upload an object with the header x-amz-server-side-encryption: AES256. What will happen?

Accepted Answer

The upload fails with an AccessDenied error.. The bucket policy shown in the exhibit (not visible here, but implied) likely denies uploads that do not use a specific encryption algorithm, such as aws:kms. The developer's upload uses AES256 (SSE-S3), which does not meet the policy's requirement, so the upload fails with an AccessDenied error. This is a common pattern to enforce encryption with a specific key type.

Answer

The upload succeeds because the policy only denies unencrypted uploads.

Answer

The upload succeeds because the policy allows all encryption methods.

Answer

The upload succeeds because the object is encrypted with AES256.

Question 15

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which key type meets this requirement?

Accepted Answer

AWS managed key (aws/s3). AWS managed keys (e.g., aws/s3) are automatically rotated every year by AWS KMS. This meets the requirement for automatic annual rotation without any customer action. Customer managed keys require the customer to enable and configure rotation, and imported key material cannot be automatically rotated.

Answer

Customer managed key with manual rotation

Answer

Asymmetric customer managed key

Answer

Imported key material in a customer managed key