SCS-C02 Data Protection Practice Test 6 — 15 Questions

Question 1

A security engineer is reviewing a KMS key policy. What does this policy accomplish?

Accepted Answer

Allow the SecurityAudit role to decrypt and re-encrypt data only from the same AWS account. The key policy includes a condition that restricts the Principal to the SecurityAudit role and the actions to Decrypt and ReEncrypt*. The condition (likely aws:SourceAccount or similar) ensures that decryption and re-encryption can only be performed from the same AWS account (123456789012). Option B is incorrect because the policy allows decryption, not denies it. Option C is incorrect because the policy applies to this specific KMS key, not to specific keys within the policy. Option D is incorrect because the policy restricts usage to the SecurityAudit role, not any user from the account.

Answer

Deny decryption to the SecurityAudit role

Answer

Allow the SecurityAudit role to use the key only for specific KMS keys

Answer

Allow any user from account 123456789012 to use the key

Question 2

A security engineer is reviewing the configuration of an S3 bucket. What is a security concern with the current configuration?

Accepted Answer

The bucket policy grants public read access to all objects. A bucket policy that grants public read access to all objects poses a significant security risk by exposing data to anyone on the internet. Option A is incorrect: enabling versioning increases storage costs but is not a security concern. Option B is incorrect: a lifecycle rule that permanently deletes current versions after 30 days is a data management policy, not a security issue. Option C is incorrect: MFA Delete is a security best practice and does not block legitimate administrative actions.

Answer

Versioning is enabled, which increases storage costs

Answer

The lifecycle rule will permanently delete current versions after 30 days

Answer

MFA Delete is enabled, which blocks legitimate administrative actions

Question 3

A security engineer is investigating a potential data breach and finds this CloudTrail log entry. What does this entry indicate?

Accepted Answer

A user decrypted data using a KMS key. The CloudTrail log entry includes an event where a user called the Decrypt API on a KMS key, indicating that data was decrypted using that key. Option A is incorrect because the event is a Decrypt, not an Encrypt. Option C is incorrect because the user is identified in the log entry (it's not anonymous). Option D is incorrect because the event is a Decrypt operation, not a deletion.

Answer

A user encrypted data using a KMS key

Answer

An anonymous user accessed the KMS key

Answer

The KMS key was deleted

Question 4

A company uses S3 to store sensitive customer data. Which AWS service can automatically discover and classify this data to help meet compliance requirements?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in S3, helping meet compliance requirements. Option D is correct. Option A (GuardDuty) is incorrect because it focuses on threat detection, not data classification. Option B (AWS Config) is incorrect as it tracks resource configuration changes. Option C (CloudWatch) is incorrect because it monitors performance and logs.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch

Question 5

A security engineer needs to ensure that all data in an S3 bucket is encrypted at rest using AWS KMS. The bucket policy must deny any PutObject request that does not include the x-amz-server-side-encryption header with value aws:kms. Which bucket policy element should be used?

Accepted Answer

Deny with condition StringNotEquals for s3:x-amz-server-side-encryption. To enforce encryption at rest with KMS, a bucket policy should use a Deny effect on s3:PutObject with a condition that the s3:x-amz-server-side-encryption header is not equal to aws:kms (using StringNotEquals). This denies any PutObject request that does not specify the required encryption. Option A is incorrect because NotPrincipal is used for denying specific principals, not for enforcing conditions. Option C is incorrect because s3:PutObjectAcl is used for setting ACLs, not encryption. Option D is incorrect because an Allow with StringEquals would only allow requests with the correct header, but would not deny requests without it; a Deny is needed to explicitly block noncompliant requests.

Answer

Deny with NotPrincipal

Answer

Deny on s3:PutObjectAcl

Answer

Allow with condition StringEquals for s3:x-amz-server-side-encryption

Question 6

A company is using AWS CloudHSM to store encryption keys for a custom application. The application needs high availability across two AWS Regions. What is the MOST secure and cost-effective approach to synchronize key material between the HSMs in each Region?

Accepted Answer

Create a backup of the source HSM and restore it to the target HSM in the second region. The correct approach is to create a backup of the source HSM and restore it to the target HSM in the second region. CloudHSM does not automatically synchronize key material across clusters or regions. Backup and restore is the supported and secure method to copy key material. Option A is incorrect because AWS KMS multi-Region keys cannot be backed by CloudHSM custom key stores across regions, and KMS does not synchronize keys across regions automatically. Option C is incorrect because exporting key material via encrypt/decrypt APIs exposes the key in plaintext and is not a secure method for synchronization. Option D is incorrect because the CloudHSM client does not provide cross-region replication functionality; it only manages local HSM operations.

Answer

Use AWS KMS multi-Region keys with custom key store backed by CloudHSM

Answer

Export the key material from the source HSM using the encrypt/decrypt API and import into the target HSM

Answer

Use the AWS CloudHSM client to replicate the key material automatically across regions

Question 7

A company is migrating a legacy application to AWS. The application stores sensitive data and must comply with PCI DSS. The security team needs to ensure that data is encrypted at rest using keys that are rotated every 12 months. Which THREE steps should the team take?

Accepted Answer

Enable AWS CloudTrail to log all KMS key usage. Options A, B, and D are correct. AWS CloudTrail logs all KMS key usage, providing an audit trail (A). Envelope encryption using a data key is a recommended practice for encrypting data with KMS (B). AWS KMS customer managed keys with automatic rotation enabled rotate annually, meeting the 12-month rotation requirement (D). Option C is incorrect because CloudHSM requires manual key rotation, not automatic. Option E is incorrect because SSE-C3 is not a valid encryption type; SSE-C uses customer-provided keys without automatic rotation.

Answer

Use AWS CloudHSM to generate and store keys, and manually rotate them every 12 months

Answer

Use S3 bucket policy to enforce SSE-C3 encryption

Question 8

A security engineer is designing a data protection strategy for an S3 bucket that contains sensitive data. The data must be encrypted at rest and the key material must be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated. Which TWO services can be used to meet these requirements?

Accepted Answer

AWS CloudHSM. To meet the requirement of FIPS 140-2 Level 3 validated HSM for key material, two services are appropriate. AWS CloudHSM provides dedicated HSMs that are FIPS 140-2 Level 3 validated. AWS KMS with a custom key store backed by CloudHSM allows you to use CloudHSM as the key store for KMS keys, ensuring that key material is stored in a Level 3 validated HSM. Options A (SSE-C) and B (SSE-S3) do not use HSM-backed keys; SSE-C uses customer-provided keys with S3 managing the encryption, and SSE-S3 uses S3-managed keys. Option E (AWS KMS with default key store) uses KMS's default key store, which is not backed by dedicated Level 3 HSMs. Therefore, only options C and D satisfy the requirements.

Answer

S3 server-side encryption with customer-provided keys (SSE-C)

Answer

S3 server-side encryption with S3 managed keys (SSE-S3)

Answer

AWS KMS with default key store

Question 9

A company wants to protect data in transit between an EC2 instance and an S3 bucket. Which method should be used?

Accepted Answer

Use HTTPS endpoints for S3 API calls. HTTPS (TLS) encrypts data in transit between EC2 and S3. S3 API endpoints support HTTPS by default. Option D is correct. Option A is incorrect because a VPN with IPsec is typically used for site-to-site VPN connections, not for securing S3 API calls. Option B is incorrect because installing an SSL certificate on the EC2 instance is for securing the EC2 instance itself (e.g., for a web server), not for encrypting traffic to S3. Option C is incorrect because SSH is used for remote administration of EC2 instances, not for data transfer to S3.

Answer

Use a VPN connection with IPsec

Answer

Install an SSL certificate on the EC2 instance

Answer

Use SSH to transfer files

Question 10

A security engineer needs to audit all access to a KMS customer managed key. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS API calls, making it the correct service to audit access to a customer managed key. Option D is correct. Option A (AWS Config) tracks resource configurations, not API calls. Option B (VPC Flow Logs) captures network traffic, not KMS operations. Option C (Amazon CloudWatch Logs) can store logs but does not generate KMS API logs; CloudTrail does.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 11

A company has a requirement to encrypt all data in an S3 bucket using keys that are stored in an on-premises HSM. Which S3 encryption option should be used?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys. The keys are not stored in AWS. Option D is correct. Option A is incorrect because SSE-S3 uses S3-managed keys. Option B is incorrect because client-side encryption encrypts locally, but the keys are managed by the customer. Option C is incorrect because SSE-KMS uses AWS KMS.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 12

A company wants to automate the detection of sensitive data in an S3 bucket. Which AWS service should be used?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to discover and classify sensitive data, making it the correct choice for automated detection of sensitive data in S3. AWS Artifact provides compliance reports, Amazon Inspector assesses vulnerabilities, and Amazon GuardDuty detects threats—none specifically focus on sensitive data detection.

Answer

AWS Artifact

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 13

A security engineer is tasked with ensuring that all data stored in an RDS DB instance is encrypted at rest. The database is already running and contains data. What should the engineer do?

Accepted Answer

Create a snapshot of the DB instance, copy it with encryption, and restore the encrypted snapshot. RDS does not support enabling encryption at rest on an existing DB instance directly. The only way to encrypt an existing unencrypted DB instance is to take a snapshot, create an encrypted copy of the snapshot, and restore it to a new encrypted DB instance. Therefore, option C is correct. Option A (changing the KMS key) does not enable encryption; it only changes the key for an already encrypted instance. Option B (modifying storage type) does not enable encryption either. Option D (enabling encryption in console) is not possible for an existing instance.

Answer

Change the KMS key associated with the DB instance

Answer

Modify the DB instance to use an encrypted storage type

Answer

Enable encryption at rest in the RDS console for the existing DB instance

Question 14

A company uses AWS KMS to encrypt data in S3. The security policy requires that keys be rotated every 12 months. Which type of KMS key supports automatic rotation?

Accepted Answer

Customer managed keys with automatic rotation enabled. Customer managed keys (CMKs) support optional automatic rotation every 12 months, meeting the security policy requirement. AWS managed keys rotate every 3 years but are not configurable, so they do not satisfy the 12-month rotation requirement. Custom key store keys and imported key material do not support automatic rotation, making option A the only correct choice.

Answer

Imported key material

Answer

Custom key store keys

Answer

AWS managed keys

Question 15

A company uses AWS KMS to encrypt data at rest in Amazon RDS for MySQL. The security team needs to ensure that the RDS instance can only be decrypted by a specific IAM role used by the production application, and not by any other IAM user or role. What is the most secure way to achieve this?

Accepted Answer

Modify the KMS key policy to allow 'kms:Decrypt' only for the production role and deny for all other principals.. The most secure way to restrict decryption of an RDS instance encrypted with KMS is to use a KMS key policy. Option D is correct because it modifies the key policy to allow 'kms:Decrypt' only for the production role and deny all other principals. Option B is incorrect because IAM policies cannot be attached directly to a KMS key; key policies are required. Option A is incorrect because key rotation and custom key stores do not restrict access. Option C is incorrect because attaching an IAM role to the RDS instance does not control KMS decryption; the key policy governs access.

Answer

Enable key rotation and use a custom key store to isolate the key.

Answer

Create an IAM policy that denies 'kms:Decrypt' to all principals except the production role, and attach it to the key.

Answer

Attach the production IAM role to the RDS instance and use a condition in the IAM role's policy to allow decrypt.