SCS-C02 Data Protection Practice Test 7 — 15 Questions

Question 1

A company uses AWS KMS to encrypt its RDS database. The security team needs to ensure that the key can be used only from within the company's VPC and not from the internet. Which action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC endpoint for KMS and modify the key policy to allow only requests from the VPC endpoint. To restrict KMS key usage to within a VPC, you create a VPC endpoint for KMS (an interface endpoint powered by AWS PrivateLink) and then modify the key policy to allow only requests that come through that endpoint. This ensures that the key cannot be used from the public internet, because requests must originate from within the VPC via the endpoint.

Answer

Enable automatic key rotation and use an alias to restrict access

Answer

Use a key policy that denies all access except from the RDS instance's security group

Answer

Create the key with a region restriction in the key policy

Question 2

A company is implementing a data protection strategy for its Amazon S3 bucket that contains sensitive data. The company requires that all objects be encrypted at rest using server-side encryption with a customer managed key (SSE-KMS). Additionally, the company wants to ensure that only a specific IAM role can decrypt objects. Which THREE actions should the company take?

Accepted Answer

Attach an IAM policy to the specific role that grants kms:Decrypt on the customer managed key. Option A is correct because granting kms:Decrypt on the customer managed key to the specific IAM role is what authorizes that role to decrypt SSE-KMS-protected objects; without this permission, KMS will deny the Decrypt call even if the role can read the object. Option B is correct because a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms enforces that every uploaded object is encrypted with SSE-KMS rather than SSE-S3 or no encryption. Option D is correct because the KMS key policy must also allow the specific IAM role to use the key for decryption; KMS requires permission from both the key policy and the IAM policy (unless the key policy delegates to IAM), so the key policy must grant the role access. Option C is incorrect because SSE-S3 uses an S3-managed key, not a customer managed KMS key, so it does not meet the SSE-KMS requirement. Option E is incorrect because client-side encryption is performed before the object reaches S3 and does not satisfy the requirement for server-side encryption with a customer managed key (SSE-KMS).

Answer

Use the default S3-managed key (SSE-S3) for encryption

Answer

Use client-side encryption with a customer managed key

Question 3

Refer to the exhibit. A security engineer is reviewing the key policy for a customer managed key. The engineer notices that a user with the IAM role 'Admin' can encrypt and decrypt data using this key. However, the engineer wants to ensure that only requests coming from the company's VPC (vpc-12345678) can use the key. What should be added to the key policy?

Accepted Answer

Add a condition aws:SourceVpc with value vpc-12345678 to the 'Allow use of the key' statement. To restrict KMS key usage to requests originating from a specific VPC, you add a condition to the key policy's 'Allow use of the key' statement using the aws:SourceVpc condition key with the value vpc-12345678. This condition evaluates the VPC endpoint through which the request arrived, ensuring only requests from that VPC can use the key. The condition is added to the existing Allow statement so that the permission is scoped to the VPC.

Answer

Add a condition kms:ViaService with value s3.amazonaws.com

Answer

Add a condition kms:CallerAccount with value 111122223333

Answer

Add a new statement with Effect: Deny and a condition aws:SourceVpc not equal to vpc-12345678

Question 4

A company uses AWS KMS to encrypt data in Amazon S3. Security team wants to ensure that only specific IAM roles can decrypt objects. Which KMS key policy configuration should be used?

Accepted Answer

In the key policy, use a Condition block with kms:ViaService set to s3..amazonaws.com and allow kms:Decrypt for the role.. The KMS key policy is the primary access control for a KMS key; IAM policies alone cannot grant access unless the key policy allows it. Using a Condition with kms:ViaService set to s3..amazonaws.com restricts the kms:Decrypt permission so it can only be used when the request originates through Amazon S3 in that region, and specifying the role ARN as Principal ensures only that role can decrypt. This combination enforces both identity and service-path restrictions.

Answer

Attach an IAM policy to the role that allows kms:Decrypt, and leave the KMS key policy with default settings.

Answer

In the key policy, use a Principal element specifying the role ARN, and allow kms:Decrypt.

Answer

Use a grant for the role to allow kms:Decrypt for S3 operations.

Question 5

A company stores sensitive data in Amazon DynamoDB and uses AWS KMS with a customer managed key for encryption. The security team wants to ensure that only specific applications can access the table data. Which policy configuration should be used?

Accepted Answer

In the KMS key policy, allow the role to decrypt with a condition kms:ViaService = dynamodb..amazonaws.com.. To ensure that only specific applications can access DynamoDB table data, the KMS key policy should allow the application role to decrypt only when the request comes through DynamoDB, enforced with the condition kms:ViaService = dynamodb..amazonaws.com. This restricts direct KMS decrypt calls and ensures the key can only be used in the context of DynamoDB operations, tightly scoping access.

Answer

In the KMS key policy, allow the application role to perform kms:Decrypt.

Answer

Use a KMS grant to allow the application to use the key.

Answer

Attach an IAM policy to the application role allowing dynamodb:GetItem and kms:Decrypt.

Question 6

A company wants to protect data in transit between an on-premises application and Amazon S3. Which solution provides the highest security?

Accepted Answer

Use an AWS PrivateLink endpoint for S3.. AWS PrivateLink connects via private IPs within the AWS network, avoiding the public internet. Option B is wrong because VPN encrypts but still traverses the internet or VPN connection. Option C is wrong because Direct Connect provides a private connection but without encryption; additional encryption is needed. Option D is wrong because HTTPS over internet uses encryption but is exposed to internet threats.

Answer

Use a site-to-site VPN connection to the VPC and then access S3 via a VPC endpoint.

Answer

Use AWS Direct Connect without additional encryption.

Answer

Access S3 over HTTPS from the on-premises application.

Question 7

A company is using AWS KMS to encrypt data in Amazon S3. They need to ensure that the KMS key can only be used from within a specific VPC. Which TWO actions should be taken?

Accepted Answer

Create a VPC endpoint for AWS KMS.. Option A is correct because AWS KMS is accessed through the AWS KMS API endpoint, and to keep KMS traffic private and tied to a VPC you must create an interface VPC endpoint (AWS PrivateLink) for KMS in that VPC, which enables requests to originate from within the VPC. Option E is correct because the KMS key policy is the primary resource-based policy that governs use of the key, and adding a condition such as "aws:SourceVpc" (or "kms:ViaService" where appropriate) on kms:Decrypt and related actions restricts key usage to requests originating from the specified VPC. Option B is not correct because an IAM identity-based policy alone cannot reliably enforce VPC origin for a KMS key; the key policy must grant/restrict access, and IAM policies do not have a native condition that validates the caller's VPC for KMS in the way described. Option C is not correct because a VPC endpoint for Amazon S3 only affects S3 data-plane traffic and does not control or restrict AWS KMS key usage. Option D is not correct because an S3 bucket policy condition restricts access to the S3 bucket, not the use of the KMS key itself.

Answer

Attach an IAM policy to the role that denies kms:Decrypt unless the request comes from the VPC.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Add a bucket policy condition to restrict access to the VPC.

Question 8

A company uses Amazon Redshift with encryption at rest using AWS KMS. They want to ensure that automated snapshots are encrypted with the same key and that cross-account snapshot sharing is secured. Which THREE steps should be taken?

Accepted Answer

Enable encryption on the Redshift cluster at creation time.. Option A is correct because Redshift encryption at rest must be enabled when the cluster is created; once enabled, all automated and manual snapshots of that cluster inherit the same KMS key, which is exactly what the scenario requires. Option C is correct because for a cross-account snapshot share to be usable, the KMS key policy must grant the target account (or its principals) permission to use the key for Decrypt, otherwise the shared snapshot cannot be restored. Option D is correct because a snapshot copy grant explicitly authorizes the target account to use the source account's KMS key when copying or restoring the encrypted snapshot, which is the required mechanism for cross-account encrypted snapshot sharing. Option B is not needed and would actually break the requirement of using the same key, since a separate snapshot key would not match the cluster's encryption key. Option E is a detective control only; an AWS Config rule can flag unencrypted snapshots but does not encrypt them or enable secure cross-account sharing.

Answer

Create a new KMS key for snapshot encryption to isolate from the cluster key.

Answer

Enable AWS Config rule to detect unencrypted snapshots.

Question 9

A company needs to implement data protection for Amazon EFS file systems. Which TWO features should be configured?

Accepted Answer

Enable encryption in transit using TLS.. Option C is correct because Amazon EFS supports encryption in transit using TLS, which protects data as it moves between the file system and its clients (for example, when mounted via the EFS mount helper with TLS). Option E is correct because EFS encryption at rest is enabled using AWS KMS keys, ensuring stored file data and metadata are encrypted on the underlying storage. Together, TLS in transit and KMS at rest provide the core data protection controls for EFS. Option A is not a data protection feature for EFS; Block Public Access applies to S3, not EFS. Option B is incorrect because EFS does not provide object versioning. Option D is a cost-optimization feature that moves files to Infrequent Access, not a data protection mechanism.

Answer

Configure EFS Block Public Access.

Answer

Enable EFS versioning.

Answer

Configure EFS lifecycle management to transition files to Infrequent Access.

Question 10

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed KMS key. What should the team configure to enforce this requirement?

Accepted Answer

Add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws:kms header.. Using a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws:kms header ensures that any upload without KMS encryption is denied. Option D (Enable default encryption) would encrypt objects at rest but does not enforce that the client must use KMS encryption; it still allows uploads without the encryption header. Option B (Block Public Access) is unrelated to encryption enforcement. Option C (Object Lock) is for retention, not encryption.

Answer

Enable S3 Block Public Access.

Answer

Configure S3 Object Lock to require encryption.

Answer

Enable default encryption on the S3 bucket with AES-256.

Question 11

A company has an S3 bucket that stores financial records. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted with a specific AWS KMS key. The team creates a bucket policy that denies s3:PutObject unless the request includes the correct encryption header. However, some users who upload objects using the AWS Management Console report that their uploads fail. What is the most likely cause?

Accepted Answer

The console uses multipart uploads, which require encryption headers on each part.. The AWS Management Console uses multipart uploads for large objects, and multipart uploads require the encryption header to be specified in each part upload. Option B is wrong because the bucket policy can enforce encryption; a KMS key policy is separate. Option C is wrong because S3 Transfer Acceleration does not affect encryption. Option D is wrong because the console respects bucket policies.

Answer

The KMS key policy does not allow the s3:PutObject operation.

Answer

The console does not support server-side encryption.

Answer

S3 Transfer Acceleration is enabled, which bypasses the bucket policy.

Question 12

A company uses AWS KMS to encrypt data in Amazon S3. The security team notices that some KMS key usage is not being logged in AWS CloudTrail. What is the most likely reason for this?

Accepted Answer

CloudTrail is not enabled in the region where the KMS key is used.. AWS KMS key usage is logged in CloudTrail only if CloudTrail is enabled in the region where the KMS key is used. If CloudTrail is not enabled in that region, KMS API calls (Encrypt, Decrypt, GenerateDataKey, etc.) will not appear in CloudTrail logs, which is the most likely reason for missing KMS usage logs.

Answer

The KMS key has automatic rotation enabled.

Answer

CloudTrail log file validation is disabled.

Answer

Only successful KMS operations are logged.

Question 13

A company uses Amazon EBS volumes for EC2 instances. The security team requires that all EBS volumes be encrypted at rest. The team creates an AWS Config rule to check whether EBS volumes are encrypted. However, some volumes are non-compliant even though they have encryption enabled. What is the most likely reason?

Accepted Answer

The volumes are not encrypted at the time of creation, even though encryption is enabled later.. The AWS Config managed rule 'encrypted-volumes' checks whether EBS volumes have encryption enabled at the time of creation. If encryption is enabled later (e.g., by changing the account's default encryption setting or by attaching the volume to an instance that enables encryption), the volume's configuration remains unchanged and is still reported as non-compliant. Option A is incorrect because volumes created from unencrypted snapshots cannot be encrypted unless the snapshot is copied with encryption; the Config rule checks the volume's encryption attribute, not the snapshot's. Option B is incorrect because the Config rule checks only if encryption is enabled, not which KMS key is used. Option D is incorrect because the rule does not evaluate KMS key aliases.

Answer

The volumes were created from unencrypted snapshots.

Answer

The volumes are encrypted with a different KMS key than the one specified in the Config rule.

Answer

The Config rule is configured to check for a specific KMS key alias.

Question 14

A company stores sensitive data in an S3 bucket and uses AWS KMS to encrypt the data. The security team wants to ensure that only specific IAM roles can decrypt the data. What should the team do?

Accepted Answer

Modify the KMS key policy to include a condition that allows kms:Decrypt only for the specific IAM roles.. The KMS key policy is the primary access control document for a KMS key; adding a condition that allows kms:Decrypt only for the specified IAM roles ensures that no other principal can use the key to decrypt, even if they have broad IAM permissions. This is the authoritative way to restrict decryption to specific roles.

Answer

Use a KMS grant to allow the roles to decrypt the key.

Answer

Attach an IAM policy to the roles that allows kms:Decrypt on the key.

Answer

Add an S3 bucket policy that denies s3:GetObject for all roles except the allowed ones.

Question 15

A company uses AWS KMS to encrypt data. The security team wants to ensure that KMS keys are not used outside of the company's AWS account. Which TWO measures would help achieve this? (Choose TWO.)

Accepted Answer

Add a key policy that denies kms:* operations for principals from other AWS accounts.. Option C is correct because a KMS key policy is the primary resource-based access control mechanism for KMS keys, and explicitly denying kms:* operations to principals outside the account (for example, using a Deny statement with a condition on aws:PrincipalAccount or a NotPrincipal element) ensures that no external AWS account can use the key, even if another policy would otherwise allow it. Option E is correct because a key policy that grants usage only to specific IAM roles within the account restricts kms:Encrypt, kms:Decrypt, kms:GenerateDataKey, and related operations to those trusted in-account principals, effectively preventing use by any other principal, including cross-account principals, since KMS requires the key policy to allow access. Option A is not correct because tags are metadata used for organization, cost allocation, and attribute-based access control conditions, but a tag by itself does not enforce any access restriction on the key. Option B is not correct because automatic key rotation is a cryptographic hygiene practice that rotates the backing key material annually; it does not control which accounts or principals can use the KMS key. Option D is not correct because disabling automatic key rotation only affects key material rotation and has no bearing on cross-account access control.

Answer

Tag the KMS key with the account ID.

Answer

Enable automatic key rotation.

Answer

Disable automatic key rotation.