SCS-C02 Data Protection Practice Test 8 — 15 Questions

Question 1

A company uses AWS KMS with a customer managed key to encrypt an S3 bucket. The security team notices that the KMS key is being used by an unintended IAM role. What is the MOST effective way to restrict the key usage to only the intended role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the key policy to allow only the intended role and deny all others. AWS KMS key policies are the primary resource-based access control mechanism for a KMS key. To restrict usage to only the intended IAM role, the key policy must explicitly allow that role and deny all other principals (or omit them from the allow statement). Modifying the key policy is the authoritative control because IAM policies alone cannot grant access unless the key policy permits it.

Answer

Remove the default key policy and attach an IAM policy to the intended role

Answer

Use an S3 bucket policy to restrict access to the intended role

Answer

Create a new KMS key and attach a new key policy

Question 2

A company needs to ensure that data in Amazon S3 is encrypted at rest using envelope encryption. The company wants to rotate the encryption key every 90 days. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use SSE-KMS with a customer managed key and manually rotate the key every 90 days.. Option D is correct because SSE-KMS with a customer managed key provides envelope encryption and allows manual key rotation to meet the 90-day requirement. AWS KMS automatic rotation is fixed at approximately 365 days, so manual rotation every 90 days is necessary. Option A is incorrect because AWS managed keys cannot be manually rotated and their automatic rotation does not meet the 90-day interval. Option B is incorrect because SSE-S3 uses S3-managed keys and does not allow customer-controlled rotation intervals; the rotation is managed by AWS and cannot be configured for 90 days. Option C is incorrect because SSE-C requires managing and providing customer keys with every request, which is high operational overhead. Both SSE-S3 and SSE-C do use envelope encryption, but they fail to meet the rotation requirement (B) or the minimal overhead requirement (C). Therefore, D is correct.

Answer

Use SSE-KMS with AWS managed key

Answer

Use SSE-S3 and enable automatic key rotation

Answer

Use SSE-C and rotate the customer-provided key every 90 days

Question 3

A company uses AWS KMS to encrypt data in Amazon Redshift. The security team needs to ensure that the KMS key cannot be deleted accidentally. What should be done?

Accepted Answer

Set a deletion window of at least 7 days. AWS KMS enforces a mandatory waiting period before a customer master key (CMK) can be deleted, and the minimum deletion window is 7 days. Setting a deletion window of at least 7 days ensures that even if a deletion is scheduled, the key remains recoverable during that period, preventing accidental permanent loss of the key and the data it protects.

Answer

Attach a key policy that denies deletion

Answer

Disable the KMS key

Answer

Enable automatic key rotation

Question 4

A company wants to protect data stored in Amazon S3 by encrypting it at rest using keys managed by the company. Which encryption option should be used?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the company to manage the encryption keys themselves while S3 performs the encryption at rest. The customer provides the key with each request, and S3 uses it to encrypt/decrypt but does not store the key. This meets the requirement of using keys managed by the company.

Answer

SSE-KMS

Answer

Client-side encryption

Answer

SSE-S3

Question 5

A company has a critical application that stores sensitive data in Amazon DynamoDB. The security team requires that all data stored in DynamoDB is encrypted at rest using a customer-managed KMS key. Additionally, they want to ensure that the key can be rotated automatically every year. Which combination of actions should be taken?

Accepted Answer

Use a customer-managed KMS key and enable automatic key rotation. DynamoDB encryption at rest is always enabled and uses AWS owned keys by default, but to meet the requirement of a customer-managed key with annual automatic rotation, you must configure a customer-managed KMS key and enable its automatic rotation. Customer-managed keys give the organization control over key policy, grants, and rotation schedule, and KMS supports automatic annual rotation for symmetric customer-managed keys. This satisfies both the customer-managed key and rotation requirements.

Answer

Use a CloudHSM key store and enable automatic rotation

Answer

Use an AWS managed KMS key and enable automatic key rotation

Answer

Enable encryption on the existing DynamoDB table and use a customer-managed KMS key

Question 6

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects in the bucket are encrypted at rest. The bucket currently has default encryption configured with SSE-S3. A new requirement mandates that all objects must be encrypted with SSE-KMS using a specific customer-managed key. What is the MOST efficient way to enforce this without re-uploading existing objects?

Accepted Answer

Update the bucket default encryption to SSE-KMS and use S3 Batch Operations to re-encrypt existing objects. Updating the bucket default encryption to SSE-KMS only affects new objects, not existing ones. To enforce the new encryption requirement on existing objects without re-uploading, you can use S3 Batch Operations to copy objects in place with new encryption settings (e.g., using the --copy-source-s3-encryption-headers or a manifest to re-encrypt). Option A is inefficient for large datasets. Option B is incorrect because S3 Lifecycle policies do not re-encrypt objects; they only transition storage classes or expire objects. Option C is incorrect because changing default encryption does not automatically re-encrypt existing objects; you must use Batch Operations or a similar mechanism.

Answer

Use S3 Inventory to list objects and a script to copy each object to itself with new encryption

Answer

Use S3 Lifecycle policy to transition objects and re-encrypt them

Answer

Update the bucket default encryption to SSE-KMS and enable automatic re-encryption

Question 7

A company wants to protect sensitive data stored in an Amazon EBS volume. The volume is attached to an EC2 instance. Which action should be taken to ensure data at rest is encrypted?

Accepted Answer

Enable EBS encryption by default for the region and create a new encrypted volume. You can enable EBS encryption by default for the region, which automatically encrypts new volumes. Option A is wrong because you cannot encrypt an existing volume directly; you must create a snapshot and restore. Option B is wrong because instance store volumes are not persistent and encryption is not managed by EBS. Option C is wrong because encryption at the application layer is not a storage encryption method.

Answer

Enable encryption on the existing EBS volume

Answer

Use an instance store volume that supports encryption

Answer

Encrypt the data at the application layer before writing to the volume

Question 8

Which THREE of the following are best practices for protecting data in transit within AWS? (Choose 3.)

Accepted Answer

Use TLS listeners on Elastic Load Balancers. Option B is correct because configuring TLS listeners on an Elastic Load Balancer (ALB/NLB) terminates encrypted HTTPS/TLS connections from clients, ensuring data in transit between clients and the load balancer is protected with strong ciphers and certificates. Option D is correct because CloudFront can be configured with a viewer protocol policy of Redirect HTTP to HTTPS (or HTTPS Only), forcing all edge-to-origin and viewer-to-edge traffic to use TLS, which protects data in transit over the public internet. Option E is correct because AWS Site-to-Site VPN establishes IPsec tunnels (using IKE and ESP with AES encryption) between on-premises networks and a VPC, encrypting data in transit across untrusted networks. Option A is not a best practice for encryption because VPC Peering itself does not provide encryption—it only routes private IP traffic between VPCs, so any encryption would need to be applied at a higher layer (e.g., TLS or IPsec). Option C is incorrect because S3 Transfer Acceleration uses AWS edge locations to speed up uploads/downloads but does not itself encrypt data in transit; encryption must still be provided via TLS/HTTPS.

Answer

Use VPC Peering with encryption

Answer

Enable S3 Transfer Acceleration

Question 9

Refer to the exhibit. A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

All objects must be encrypted with SSE-S3. The bucket policy shown in the exhibit (not visible here, but implied by the correct answer) enforces that all objects must be encrypted with SSE-S3. The policy likely uses a condition that denies uploads unless the x-amz-server-side-encryption header equals 'AES256'. This ensures that any PUT request without SSE-S3 encryption is rejected.

Answer

The policy has no effect because the condition is invalid

Answer

Objects without encryption headers are allowed

Answer

All objects must be encrypted with SSE-KMS

Question 10

Refer to the exhibit. A user receives the above error when trying to decrypt a file using AWS KMS. The key policy is shown below:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AdminRole"
      },
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the likely cause of the error?

Accepted Answer

The IAM user 'john' is not granted kms:Decrypt in the key policy. AWS KMS key policies are resource-based policies that must explicitly grant principals permission to use the key. The shown policy only allows the role AdminRole to call kms:Decrypt, so the IAM user 'john' has no permission from the key policy. Even if john had an IAM policy allowing kms:Decrypt, the key policy must also grant access (unless the key policy delegates to IAM). This mismatch is the likely cause of the decryption error.

Answer

The ciphertext was encrypted with a different KMS key

Answer

The KMS key does not exist

Answer

The command syntax is incorrect

Question 11

A company runs a critical application on Amazon EC2 instances that store sensitive data on EBS volumes. The security team has enabled EBS encryption by default for the region. However, after a recent security audit, it was discovered that some EBS volumes are not encrypted. The team finds that these volumes were created before the default encryption setting was enabled. The company's security policy mandates that all EBS volumes must be encrypted at rest, and the process must minimize downtime. The application cannot tolerate more than 5 minutes of downtime. The EC2 instances are running production workloads. What should the security engineer do to remediate the unencrypted volumes?

Accepted Answer

Create a new encrypted EBS volume, detach the unencrypted volume, and attach the new encrypted volume to the instance. Then copy data from a backup.. It allows creating a new encrypted volume and attaching it to the instance without significant downtime (a few minutes for detachment/attachment). Option A is wrong because enabling encryption on an existing volume is not supported. Option C is wrong because stopping the instance and creating an encrypted snapshot/volume would cause more downtime (stop/start). Option D is wrong because migrating to a new instance would require additional setup and likely more downtime.

Answer

Enable encryption on the existing EBS volumes directly from the console

Answer

Stop the instance, create an encrypted snapshot of the unencrypted volume, restore a new encrypted volume from the snapshot, and start the instance

Answer

Launch a new EC2 instance with an encrypted EBS volume, migrate the application to the new instance, and terminate the old instance

Question 12

A company uses AWS Secrets Manager to rotate secrets for an RDS database. The rotation fails with an error indicating that the secret cannot be accessed. What is the most likely cause?

Accepted Answer

The Lambda rotation function lacks IAM permissions to update the secret. The most likely cause is that the Lambda rotation function's IAM role lacks permissions to call secretsmanager:PutSecretValue or UpdateSecret on the secret, which is required to write the new credential back. Rotation failures with 'cannot be accessed' errors commonly stem from missing or misconfigured IAM policies on the rotation Lambda's execution role.

Answer

The KMS key used to encrypt the secret is disabled

Answer

The secret is not encrypted

Answer

The secret is not in the same region as the database

Question 13

A company wants to encrypt data in transit between an on-premises data center and AWS over a VPN connection. Which AWS service or feature should be used?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN establishes an encrypted IPsec tunnel between an on-premises data center and AWS over the public internet, providing encryption in transit for data traversing the VPN connection. It is the standard AWS service for secure hybrid connectivity with encryption.

Answer

AWS Route 53 Resolver

Answer

AWS Certificate Manager (ACM)

Answer

Amazon API Gateway

Question 14

A company needs to protect sensitive data in Amazon S3 from accidental deletion or overwriting. The data must be retained for at least 7 years after creation. Which combination of S3 features should be used?

Accepted Answer

Enable S3 Object Lock in Governance mode and configure a lifecycle policy to expire objects after 7 years. S3 Object Lock in Governance mode prevents objects from being deleted or overwritten during the retention period, and a lifecycle policy can automatically expire objects after 7 years to meet the retention requirement. Option A is incorrect because Object Lock in Compliance mode also prevents deletion and overwriting, but without specifying a retention period, it does not enforce the 7-year retention; additionally, Compliance mode cannot be overridden, which may be too restrictive. Option B is incorrect because S3 Intelligent-Tiering and lifecycle policies manage storage costs and transitions, not protection against deletion or overwriting. Option C is incorrect because versioning and MFA Delete protect against accidental deletion and preserve overwritten versions, but do not guarantee a 7-year retention period; lifecycle policies would be needed to enforce it.

Answer

Enable S3 Versioning and enable S3 Object Lock in Compliance mode

Answer

Use S3 Intelligent-Tiering and lifecycle policies

Answer

Enable S3 Versioning and MFA Delete

Question 15

Refer to the exhibit. An administrator is investigating why an application that uses KMS for encryption is failing. The IAM role used by the application has the following policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ] }. What is the most likely cause of the failure?

Accepted Answer

The KMS key is disabled. The most likely cause is that the KMS key is disabled. The IAM policy correctly allows kms:Decrypt on the specified key ARN, so permissions are not the issue. If the key is disabled, any attempt to use it for decryption will fail, even with proper permissions.

Answer

The KMS key has been deleted

Answer

The IAM policy does not specify the correct key ARN

Answer

The IAM policy does not allow the kms:Decrypt action