SCS-C02 Data Protection Practice Test 8 — 15 Questions

Question 1

A company is using AWS KMS to encrypt data in Amazon Redshift. They need to rotate the KMS key annually. Which approach meets the requirement with minimal operational impact?

Accepted Answer

Enable automatic key rotation on the KMS key. AWS KMS supports automatic annual key rotation for customer-managed KMS keys. Enabling this feature automatically rotates the key material once per year with no manual intervention, minimal operational overhead, and no impact on the Redshift cluster, which continues to use the same key ID.

Answer

Create a new KMS key each year and update the Redshift cluster to use the new key

Answer

Use an AWS Lambda function to rotate the key every year

Answer

Rotate the key by re-importing key material into an existing KMS key

Question 2

Refer to the exhibit. A security engineer applies the bucket policy to an S3 bucket. A user uploads an object without specifying any encryption header. What happens?

Accepted Answer

The request is denied with an Access Denied error. The bucket policy denies PutObject if the encryption header is not 'aws:kms'. Since the user did not specify any encryption header, the condition 'aws:SecureTransport'? Actually, the policy condition likely checks 's3:x-amz-server-side-encryption' for 'aws:kms'. Without the header, the condition evaluates true (header is not 'aws:kms'), so the request is denied with Access Denied. Option C is correct. Option A is wrong because default encryption is not applied when the policy denies; B is wrong because the policy requires the header to be explicitly set; D is wrong because the policy denies the upload entirely.

Answer

The object is uploaded and encrypted with the bucket's default SSE-S3

Answer

The object is uploaded and encrypted with SSE-KMS

Answer

The object is uploaded without encryption

Question 3

A company uses Amazon DynamoDB with client-side encryption using AWS KMS. The application is experiencing high latency on write operations. Which change is most likely to reduce latency?

Accepted Answer

Cache the data key locally and reuse it for multiple items. Client-side encryption with AWS KMS typically involves calling the KMS GenerateDataKey API to obtain a data key, which is then used to encrypt items locally. Each KMS API call adds network latency. By caching the data key locally and reusing it for multiple items, you eliminate repeated KMS round trips, significantly reducing per-write latency. This is a well-known optimization for client-side encryption patterns.

Answer

Switch to server-side encryption with KMS

Answer

Increase the provisioned write capacity of the table

Answer

Use DynamoDB Accelerator (DAX)

Question 4

A company is designing a data protection strategy for Amazon S3. Which TWO of the following are valid methods to protect data at rest in S3?

Accepted Answer

Server-side encryption with S3-managed keys (SSE-S3). Server-side encryption with S3-managed keys (SSE-S3) encrypts data at rest using AES-256, with Amazon S3 managing the encryption/decryption process and key rotation automatically. This is a valid method to protect data at rest in S3 because it ensures objects are encrypted before being written to disk and decrypted when accessed, without requiring any additional client-side logic or key management overhead.

Answer

S3 Versioning

Answer

S3 bucket policies

Answer

MFA Delete

Question 5

A security engineer is configuring a new AWS KMS customer managed key. Which THREE of the following are required components of a KMS key policy?

Accepted Answer

A statement that grants key usage permissions to specific IAM users or roles. A KMS key policy must include a statement that gives the AWS account root access (Option D) to allow the account to delegate permissions via IAM policies. It must also include a statement granting key administration permissions to specific IAM roles (Option C) so that administrators can manage the key. Additionally, a statement granting key usage permissions to IAM users or roles (Option A) is typically required to enable encryption/decryption operations. The key alias (Option B) is defined separately and is not a component of the key policy. Automatic key rotation (Option E) is an optional configuration, not a required policy statement.

Answer

A statement that defines the key alias

Answer

A statement that enables automatic key rotation

Question 6

A company uses AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that integrity is verified. Which TWO services can be used together to achieve this?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation (option C) provides a built-in mechanism to verify that log files have not been modified, deleted, or tampered with after delivery. It uses SHA-256 hashing and digital signatures (based on RSA) to create a digest file that can be independently validated. AWS KMS (option D) allows you to encrypt CloudTrail log files at rest using server-side encryption (SSE-KMS), ensuring that the logs are stored in an encrypted format. Together, they meet both the encryption-at-rest and integrity verification requirements.

Answer

S3 Inventory

Answer

AWS CloudHSM

Answer

S3 MFA Delete

Question 7

A financial services company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application processes credit card numbers and stores them in an Amazon RDS for PostgreSQL database. The database is encrypted at rest using AWS KMS. The security team is concerned about data in transit between the ALB and EC2 instances, and between EC2 and RDS. They also want to ensure that the application never logs the full credit card number. The current setup: ALB terminates SSL using a certificate from AWS Certificate Manager (ACM). EC2 instances are in a private subnet. RDS is in a private subnet. The application logs to CloudWatch Logs. The security team reviews the logs and finds full credit card numbers in the logs. Which of the following actions should the security engineer take to address the data protection issues?

Accepted Answer

Modify the application to use TLS when connecting to RDS and update the application code to mask or truncate credit card numbers before logging. It directly addresses both issues: ensuring data in transit between EC2 and RDS uses TLS, and preventing credit card numbers from being logged by masking them in application code before logging. Option A only redacts logs after they are sent to CloudWatch, which is reactive and does not prevent the exposure in transit or in logs. Option B focuses on encryption at rest (already done) and SSL connections to RDS, but does not fix the logging issue. Option D suggests using HTTPS between ALB and EC2 and a self-signed certificate, but the ALB already terminates SSL; re-encrypting to EC2 would require instance-level certificate management and does not address logging.

Answer

Create a CloudWatch Logs subscription filter to redact credit card numbers from the logs after they are sent to CloudWatch

Answer

Enable RDS encryption with a new KMS key and enforce that all connections to RDS use SSL

Answer

Enable encryption in transit between the ALB and EC2 by using HTTPS listeners and configure the ALB to re-encrypt traffic to EC2 using a self-signed certificate on each instance

Question 8

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific IAM role can decrypt objects. What is the MOST secure way to achieve this?

Accepted Answer

Use a customer managed KMS key with a key policy that grants kms:Decrypt only to the specific IAM role, and configure the S3 bucket policy to allow only that role to access the bucket.. The most secure approach because it uses a customer managed KMS key with a key policy that grants kms:Decrypt only to the specific IAM role. Combined with an S3 bucket policy that restricts bucket access to that same role, this ensures that only the designated role can both access the S3 objects and decrypt them. Option B is incorrect because automatic key rotation does not control access permissions. Option C is incorrect because the S3 bucket policy alone cannot control decryption permissions; the KMS key policy is also required. Option D is incorrect because using an AWS managed key and S3 default encryption does not restrict decryption to a specific IAM role.

Answer

Enable automatic key rotation in KMS and assign the key to the IAM role.

Answer

Configure an S3 bucket policy that denies all users except the specific IAM role.

Answer

Use S3 default encryption with an AWS managed key and trust the IAM role.

Question 9

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The application runs on Amazon EC2 instances and uses the PKCS#11 interface to interact with the HSM. The security team recently discovered that a former employee may have obtained a copy of the cryptographic materials from the HSM. What should the security team do to minimize the impact?

Accepted Answer

Delete the CloudHSM backup from the backup service. Then rotate all keys that were stored in the HSM.. Deleting the CloudHSM backup prevents the former employee from restoring the HSM's contents from a backup. Rotating all keys ensures that any keys the employee may have copied are no longer valid for encrypting/decrypting data, minimizing the impact of the exposure. Option A is incorrect because AWS KMS cannot manage keys stored in CloudHSM. Option C is incorrect because changing passwords does not invalidate cryptographic material that has already been copied. Option D is incorrect because deleting the HSM cluster alone does not delete the backup, and restoring from an old backup may reintroduce the compromised keys.

Answer

Use AWS KMS to create a new key and re-encrypt all data. Then revoke the old key.

Answer

Change the HSM administrator password and the crypto user passwords.

Answer

Delete the HSM cluster and create a new one. Restore the backup from a known good time.

Question 10

A company wants to encrypt data stored in Amazon S3 using server-side encryption with customer-provided keys (SSE-C). Which statement is correct regarding SSE-C?

Accepted Answer

The customer provides the encryption key in each request to S3.. SSE-C requires the customer to provide the encryption key and its MD5 digest in every PUT or GET request to Amazon S3. S3 uses the key to encrypt the object at rest and then discards the key; it is never stored by AWS. This ensures the customer retains full control over the encryption key material.

Answer

AWS manages the encryption keys.

Answer

The same encryption key is used for all objects in the bucket.

Answer

The encryption key is stored in AWS KMS.

Question 11

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that if a KMS key is disabled, all subsequent attempts to decrypt data encrypted with that key fail. What is the BEST way to achieve this?

Accepted Answer

Disable the KMS key.. Disabling a KMS key immediately prevents use of that key for decryption, so all subsequent decryption attempts fail. Option A is wrong because rotating a key does not affect the existing key's ability to decrypt data encrypted with it. Option B is wrong because revoking grants only removes permissions granted via grants; it does not affect the key policy or direct access, so decryption may still succeed. Option D is wrong because deleting a key is irreversible and can cause permanent data loss; disabling is sufficient and safer.

Answer

Rotate the KMS key immediately.

Answer

Revoke all grants associated with the KMS key.

Answer

Delete the KMS key.

Question 12

Which TWO of the following are valid methods to protect data in transit between an on-premises data center and AWS? (Choose two.)

Accepted Answer

AWS Site-to-Site VPN. Options B and E are correct. AWS Site-to-Site VPN creates an encrypted tunnel over the internet, protecting data in transit. AWS Direct Connect with MACsec provides encryption over a private physical connection. Option A is incorrect because CloudFront with HTTPS only encrypts between viewer and edge locations, not necessarily between the origin and edge, and it is not a method to connect on-premises directly to AWS. Option C is incorrect because VPC Peering does not encrypt traffic; it only routes between VPCs. Option D is incorrect because S3 Transfer Acceleration only speeds up transfers using edge locations but does not provide encryption.

Answer

Amazon CloudFront with HTTPS-only viewer protocol policy

Answer

VPC Peering

Answer

S3 Transfer Acceleration

Question 13

Which THREE of the following are required to use client-side encryption with Amazon S3 using AWS KMS? (Choose three.)

Accepted Answer

The encrypted data key is stored as metadata with the S3 object.. Options B, D, and E are correct. The client must call kms:GenerateDataKey (Option D) to obtain a data key, which is then used to encrypt the data. The encrypted data key is stored as metadata with the S3 object (Option B). The AWS SDK Encryption Client library (Option E) handles the client-side encryption process. Option A is wrong because an S3 bucket policy forcing encryption is not required for client-side encryption; that is used for server-side encryption enforcement. Option C is wrong because the KMS key policy does not need to allow the S3 service to decrypt; client-side encryption does not involve S3 decrypting the data.

Answer

An S3 bucket policy that forces encryption.

Answer

A KMS key policy that allows the S3 service to decrypt.

Question 14

Which TWO of the following are valid options for encrypting data at rest in Amazon EBS? (Choose two.)

Accepted Answer

Enable EBS encryption by default using the AWS managed key for EBS.. Options A and B are correct. EBS encryption can be enabled using either the AWS managed key for EBS (option A) or a customer managed KMS key (option B). Option C is incorrect because EBS encryption is not performed by a script on the EC2 instance; it is handled by AWS KMS. Option D is incorrect because CloudHSM is not directly used for EBS encryption (though it can be used as a key source via KMS custom key stores, it is not a direct option for encrypting EBS volumes). Option E is incorrect because S3 server-side encryption applies to objects in S3, not to EBS snapshots; EBS snapshots can be encrypted using KMS keys.

Answer

Use an encryption script on the EC2 instance to encrypt the volume.

Answer

Use AWS CloudHSM to generate and store the encryption key.

Answer

Use S3 server-side encryption to encrypt the EBS snapshot.

Question 15

Refer to the exhibit. An IAM policy allows kms:Decrypt on a specific KMS key only when the encryption context includes department=finance. A user attempts to decrypt an S3 object that was encrypted with the same KMS key but with encryption context department=hr. Will the decryption succeed?

Accepted Answer

No, because the encryption context does not match.. The IAM policy requires the encryption context to include department=finance for kms:Decrypt. Since the object was encrypted with department=hr, the encryption context does not match, and the decryption fails. Option B is incorrect because the key policy is not the issue; the IAM policy restricts based on encryption context. Option C is incorrect because while the user has kms:Decrypt permission on the key, the condition on that permission is not satisfied. Option D is incorrect because kms:DescribeKey permission is irrelevant to decryption; the condition on kms:Decrypt is not met.

Answer

No, because the key policy does not allow the user to decrypt.

Answer

Yes, because the user has kms:Decrypt permission on the key.

Answer

Yes, if the user also has kms:DescribeKey permission.