SCS-C02 Data Protection Practice Test 7 — 15 Questions

Question 1

A company is using Amazon S3 to store sensitive customer data. They need to ensure that data is encrypted at rest and that the encryption keys are managed by the company, not AWS. Which S3 encryption option should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSE-C. SSE-C is correct because it allows customers to provide and manage their own encryption keys. SSE-S3 uses AWS-managed keys. SSE-KMS uses AWS KMS keys which are managed by AWS, though the customer can manage KMS key policies but not the actual encryption keys used by S3. Client-side encryption is not an S3 server-side encryption option.

Answer

Client-side encryption

Answer

SSE-KMS

Answer

SSE-S3

Question 2

A company is designing a data lake on Amazon S3. The data contains personally identifiable information (PII). The security team requires that all data be encrypted at rest and that access to the data is logged for auditing. Additionally, the team wants to ensure that if an object is accidentally deleted, it can be recovered within 30 days. Which combination of S3 features should be enabled?

Accepted Answer

Enable SSE-KMS, S3 Versioning, and S3 Server Access Logs.. SSE-KMS provides encryption at rest with integrated audit trails via AWS CloudTrail for key usage, S3 Versioning allows recovery of accidentally deleted objects within the versioning retention period (which can be managed via lifecycle policies), and S3 Server Access Logs provide detailed records of requests made to the bucket for auditing. Option A is incorrect because SSE-C does not provide key management audit, and Lifecycle policies do not directly help with recovery of deleted objects. Option B is incorrect because S3 Inventory is used for auditing object metadata and replication, not for recovery or access logging. Option D is incorrect because default encryption with SSE-S3 does not provide per-object key audit trails, and CloudTrail is not primarily for S3 data events (it can log, but Server Access Logs are more detailed).

Answer

Enable SSE-C, S3 Lifecycle policies, and CloudWatch Logs.

Answer

Enable SSE-KMS, S3 Versioning with MFA Delete, and S3 Inventory.

Answer

Enable default encryption (SSE-S3), S3 Versioning, and AWS CloudTrail.

Question 3

A company uses AWS KMS to encrypt EBS volumes attached to EC2 instances. The security team wants to ensure that when an EC2 instance is terminated, the associated EBS volume is automatically deleted and the data is unrecoverable. However, the team also needs to retain the volume's data for 90 days for compliance purposes. What is the most secure and cost-effective approach?

Accepted Answer

Before termination, create a snapshot of the volume, copy the snapshot encrypted with a new KMS key, then delete the volume and the original snapshot after 90 days.. It ensures both compliance retention and data unrecoverability. By creating a snapshot before termination, then copying it with a new KMS key, you maintain an encrypted copy that is independent of the original key. The original volume and snapshot can then be deleted after the retention period, ensuring the original data is unrecoverable. Option A is incorrect because Amazon Data Lifecycle Manager can create snapshots automatically, but it does not automatically re-encrypt them with a new key; without re-encryption, the snapshot remains accessible if the original key permissions allow it. Option C is incorrect because simply disabling the KMS key renders the volume inaccessible but does not guarantee data deletion; the encrypted data still exists and could be recovered if the key is re-enabled. Additionally, it prevents any further access to the data, including for compliance review. Option D is incorrect because setting DeleteOnTermination to true deletes the volume immediately upon termination, which prevents any data retention for 90 days.

Answer

Use Amazon Data Lifecycle Manager to create a snapshot and delete the volume after termination.

Answer

Disable the KMS key used to encrypt the volume, then terminate the instance.

Answer

Configure the EC2 instance with 'DeleteOnTermination' attribute set to true and enable termination protection.

Question 4

A company is using Amazon S3 to store sensitive customer data. They need to ensure that data is encrypted at rest and that the encryption keys are managed by the company, not AWS. Which S3 encryption option should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Condition: 's3:x-amz-server-side-encryption': 'aws:kms'. Using the condition key 's3:x-amz-server-side-encryption' with value 'aws:kms' enforces that all objects uploaded to the bucket must use server-side encryption with AWS KMS (SSE-KMS). Option A is incorrect because it enforces SSE-C (customer-provided key), not SSE-KMS. Option C is incorrect because it checks the KMS key ID but does not enforce that encryption is actually requested; a request without any encryption header would still succeed. Option D is incorrect because it enforces SSE-S3 (AES256), not SSE-KMS.

Answer

Condition: 's3:x-amz-server-side-encryption-customer-algorithm': 'AES256'

Answer

Condition: 's3:x-amz-server-side-encryption-aws-kms-key-id': 'arn:aws:kms:...'

Answer

Condition: 's3:x-amz-server-side-encryption': 'AES256'

Question 5

A company uses AWS KMS with a custom key store backed by AWS CloudHSM. The security team wants to ensure that the key material never leaves the HSM and that all cryptographic operations are performed within the HSM. Which of the following actions should the team take?

Accepted Answer

Create the KMS key in a custom key store and set the key usage to 'ENCRYPT_DECRYPT'.. To ensure key material never leaves the HSM and cryptographic operations are performed within the HSM, the team should create the KMS key in a custom key store (backed by CloudHSM) and set the key usage to ENCRYPT_DECRYPT. This ensures that the key material is stored and used only within the HSM. Option A is incorrect because asymmetric keys with SIGN_VERIFY usage are not the standard for encryption/decryption, and the key material could potentially be exported if the HSM allows. Option B is incorrect because the 'Prevent key material export' option is not available in KMS; custom key stores inherently prevent export. Option C is incorrect because the default key store uses software-based keys, not HSM hardware. Therefore, Option D is the correct answer.

Answer

Create the KMS key as an asymmetric key in a custom key store and set the key usage to 'SIGN_VERIFY'.

Answer

Enable the 'Prevent key material export' option in the KMS key policy.

Answer

Create the KMS key as a symmetric key in the default key store.

Question 6

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to detect any attempts to use a KMS key that has been disabled. Which TWO steps should the team take to achieve this? (Select TWO.)

Accepted Answer

Enable AWS CloudTrail trails for the account to log KMS events.. Options A and B are correct. Enabling CloudTrail trails (A) captures all KMS API calls, including failed attempts to use a disabled key. Configuring a CloudWatch Events rule to send a notification to an SNS topic (B) ensures alerts are sent when such attempts occur. Option D is incorrect because it only triggers on the 'DisableKey' event, which indicates when a key is disabled, not when someone attempts to use a disabled key. Options C and E are incorrect because key rotation and disabling rotation do not help detect attempts to use a disabled key.

Answer

Configure automatic KMS key rotation to generate daily events.

Answer

Create a CloudWatch Events rule that matches the 'DisableKey' event from KMS.

Answer

Disable key rotation to prevent key material changes.

Question 7

A company is storing sensitive data in Amazon S3. They want to ensure that all data is encrypted at rest using server-side encryption. Which THREE options are available for server-side encryption in S3? (Select THREE.)

Accepted Answer

SSE-KMS. The three server-side encryption options in Amazon S3 are SSE-S3, SSE-KMS, and SSE-C. Option A (client-side encryption) is incorrect because it is not server-side. Option E (AWS CloudHSM) is incorrect because CloudHSM is a service for hardware security modules, not an S3 encryption option.

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 8

A company is migrating its on-premises data warehouse to AWS. The data includes highly sensitive customer financial information. The company has the following requirements: 1) All data must be encrypted at rest using a key that is managed by the company's internal security team. 2) The encryption keys must be rotated every 90 days. 3) The data warehouse must support SQL queries and be highly available across multiple Availability Zones. 4) The solution must minimize the administrative overhead of managing keys. The security team has chosen Amazon Redshift as the data warehouse. They have enabled encryption using AWS KMS with a customer-managed key (CMK). They have set the key rotation period to 90 days using automatic key rotation. However, during a security review, an auditor points out that the key material is still stored in AWS KMS, and the company wants the key material to be stored in a hardware security module (HSM) that they control. Which of the following is the BEST course of action to meet the auditor's requirement while maintaining the other requirements?

Accepted Answer

Create a custom key store in AWS KMS backed by an AWS CloudHSM cluster, and use a KMS key in that custom key store to encrypt the Redshift cluster.. Create a custom key store in AWS KMS backed by an AWS CloudHSM cluster, and use a KMS key in that custom key store to encrypt the Redshift cluster. This meets the requirement of storing key material in a company-controlled HSM while allowing automatic key rotation (KMS handles rotation of the key within the custom key store, but note that the actual key material in CloudHSM may need manual rotation depending on policy). Option A is incorrect because AWS CloudHSM alone is not directly supported by Redshift for encryption; Redshift requires integration via KMS custom key store. Option C is incorrect because Amazon S3 server-side encryption with SSE-C is not applicable to Redshift; Redshift is a separate service and cannot use SSE-C. Option D is incorrect because importing key material into KMS still stores the key material in KMS, not in an HSM controlled by the company; the custom key store with CloudHSM is required.

Answer

Use AWS CloudHSM directly to generate and manage the encryption keys, and configure Redshift to use those keys via the CloudHSM client.

Answer

Switch to using Amazon S3 server-side encryption with customer-provided keys (SSE-C) and use Redshift Spectrum to query the data.

Answer

Generate the key material on-premises and import it into KMS as a customer-managed key, then use that key for Redshift encryption.

Question 9

A company is migrating sensitive data to Amazon S3. They need to ensure that data is encrypted at rest using an AWS KMS customer managed key (CMK). The security team wants to enforce encryption for all new objects uploaded to an S3 bucket. Which policy should be attached to the bucket?

Accepted Answer

A bucket policy with a condition that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws:kms header. It uses a bucket policy condition that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms (though the option text shows a combined form). This enforces the use of AWS KMS customer managed key (CMK) for server-side encryption. Option A is incorrect because it only allows PutObject if the user has KMS permissions, which does not guarantee the object is encrypted with KMS; the user could still upload without encryption. Option B configures default encryption, but it can be overridden by the uploader; it does not enforce encryption. Option C is about lifecycle policy, not encryption enforcement.

Answer

A bucket policy that allows s3:PutObject only if the user has KMS permissions

Answer

An S3 bucket default encryption setting with AES256

Answer

An S3 Lifecycle policy to transition objects to Glacier after 30 days

Question 10

A security engineer is troubleshooting an issue where an Amazon RDS for MySQL DB instance encrypted at rest with AWS KMS is failing to launch. The error message indicates a KMS access issue. Which IAM role or policy is most likely missing?

Accepted Answer

The AWSServiceRoleForRDS service-linked role is missing. The AWSServiceRoleForRDS service-linked role is required for RDS to call AWS KMS on your behalf to manage encryption keys for encrypted DB instances. If this role is missing, RDS cannot obtain the necessary permissions to decrypt the KMS key during instance launch, resulting in a KMS access error. This role is automatically created the first time you create an RDS resource, but if it was deleted or not present, you must recreate it to resolve the issue.

Answer

The RDS subnet group is in a private subnet without a NAT gateway

Answer

The DB instance's security group does not allow outbound traffic to KMS

Answer

The KMS key policy does not grant access to the root account

Question 11

A company uses AWS CloudHSM to store encryption keys for a custom database encryption application. The application runs on Amazon EC2 instances and uses the PKCS#11 library to communicate with the HSM. Recently, the application started failing with 'CKR_SESSION_HANDLE_INVALID' errors. Which of the following is the most likely cause?

Accepted Answer

The application is not closing sessions properly, causing the HSM to reach the maximum number of open sessions. CloudHSM partitions have a limit on the number of open sessions. If the application does not properly close sessions, it can exhaust the limit, causing invalid session handle errors. Option C identifies this. Option A would cause different errors, B is about connectivity, D is about certificates.

Answer

The client certificate used for mutual TLS authentication has expired

Answer

The security group for the HSM does not allow inbound traffic from the EC2 instance

Answer

The HSM's firmware version is incompatible with the PKCS#11 library

Question 12

A company uses S3 Server Access Logs to audit access to their S3 buckets. The security team wants to ensure that the log files themselves are encrypted at rest using SSE-KMS. Which configuration step is necessary?

Accepted Answer

Add a bucket policy on the destination bucket that grants the S3 log delivery service permission to use the KMS key. To encrypt S3 Server Access Logs using SSE-KMS, the destination bucket's bucket policy must grant the S3 log delivery service permission to use the KMS key. This allows S3 to encrypt log objects with that key. Option C is correct. Option A is about denying unencrypted uploads to the source bucket, which does not affect log encryption. Option B enables default encryption on the source bucket, but logs are written to the destination bucket. Option D is about lifecycle policies, which do not control encryption.

Answer

Use an S3 bucket policy to deny unencrypted uploads to the source bucket

Answer

Enable default encryption on the source bucket

Answer

Configure the destination bucket with a lifecycle policy

Question 13

A company is designing a data protection strategy for Amazon EBS volumes. They want to automate the creation of point-in-time snapshots for all production volumes and retain them for 90 days. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use Amazon Data Lifecycle Manager (DLM) to create a policy that takes snapshots daily and retains them for 90 days. Amazon Data Lifecycle Manager (DLM) is the native AWS service designed to automate the creation and retention of EBS snapshots. It allows you to define policies for snapshot schedules (e.g., daily) and retention periods (e.g., 90 days) with minimal operational overhead. Option B is correct because DLM handles both creation and automated deletion based on the retention policy, eliminating the need for custom scripts or additional services. Option A requires managing a script and an EC2 instance, adding complexity. Option C adds unnecessary overhead with Lambda and CloudWatch. Option D, AWS Backup, can also manage EBS backups but is more suited for broader backup strategies and may involve more configuration; DLM is simpler for purely EBS snapshot automation.

Answer

Write a script using the AWS CLI that creates snapshots and runs on a schedule via cron on an EC2 instance

Answer

Use an AWS Lambda function triggered by CloudWatch Events to create snapshots and delete old ones

Answer

Use AWS Backup to create a backup plan for EBS volumes with a 90-day retention

Question 14

A company wants to protect data in transit between an on-premises data center and Amazon S3. Which AWS service should be used to establish a dedicated, encrypted connection?

Accepted Answer

AWS Direct Connect with an IPsec VPN. AWS Direct Connect with IPsec VPN provides a dedicated private connection with encryption, ensuring data in transit is protected. Direct Connect alone (without VPN) is private but not encrypted by default; adding IPsec VPN over the Direct Connect link provides encryption. Option A is Direct Connect without VPN, which lacks encryption. Option B, AWS Transit Gateway, is a network transit hub, not a direct connection service. Option D, Site-to-Site VPN over the internet, uses the public internet and is not dedicated. Therefore, the correct answer is C.

Answer

AWS Direct Connect without VPN

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN over the internet

Question 15

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects be encrypted with server-side encryption using customer-provided encryption keys (SSE-C). A developer uploads objects using the AWS SDK but forgets to include the encryption key in the request. What happens to the upload?

Accepted Answer

The upload succeeds but the object is stored without server-side encryption. With SSE-C, the request must include the encryption key. If not provided, the upload succeeds but the object is stored without server-side encryption (i.e., as plaintext). Option C is correct. Option A is wrong because S3 does not deny; B is wrong because no error; D is wrong because default encryption is not applied.

Answer

The upload succeeds and the object is encrypted with the default S3 managed key

Answer

The upload succeeds and the object is encrypted with the bucket's default encryption settings

Answer

The upload fails with a 400 Bad Request error