SCS-C02 Data Protection Practice Test 8 — 15 Questions

Question 1

A company uses AWS KMS to encrypt data at rest in Amazon RDS for MySQL. The security team needs to ensure that the RDS instance can only be decrypted by a specific IAM role used by the production application, and not by any other IAM user or role. What is the most secure way to achieve this?

Accepted Answer

Modify the KMS key policy to allow 'kms:Decrypt' only for the production role and deny for all other principals.. Option B is correct because using a KMS key policy that grants decrypt permission only to the production role ensures that only that role can decrypt the RDS instance. Option A is wrong because IAM policies alone cannot restrict decryption if the key policy allows broader access. Option C is wrong because RDS does not support attaching IAM roles at the instance level for this purpose. Option D is wrong because it makes the key accessible to all users.

Answer

Enable key rotation and use a custom key store to isolate the key.

Answer

Create an IAM policy that denies 'kms:Decrypt' to all principals except the production role, and attach it to the key.

Answer

Attach the production IAM role to the RDS instance and use a condition in the IAM role's policy to allow decrypt.

Question 2

A company is using Amazon S3 to store sensitive customer data. They need to ensure that data is encrypted at rest and that the encryption keys are managed by the company, not AWS. Which S3 encryption option should they use?

Accepted Answer

SSE-C. Option C is correct because SSE-C allows the customer to provide their own encryption keys and manage them. Option A is wrong because SSE-S3 uses AWS-managed keys. Option B is wrong because SSE-KMS uses AWS-managed KMS keys. Option D is wrong because client-side encryption is not an S3 server-side encryption option.

Answer

Client-side encryption

Answer

SSE-KMS

Answer

SSE-S3

Question 3

A company is designing a data lake on Amazon S3. The data contains personally identifiable information (PII). The security team requires that all data be encrypted at rest and that access to the data is logged for auditing. Additionally, the team wants to ensure that if an object is accidentally deleted, it can be recovered within 30 days. Which combination of S3 features should be enabled?

Accepted Answer

Enable SSE-KMS, S3 Versioning, and S3 Server Access Logs.. Option A is correct because server-side encryption with KMS (SSE-KMS) provides encryption at rest with audit trails via CloudTrail, S3 Versioning allows recovery of deleted objects, and S3 Server Access Logs record access. Option B is wrong because default encryption does not provide key-specific audit. Option C is wrong because MFA Delete is not required for recovery. Option D is wrong because lifecycle policies do not help with recovery.

Answer

Enable SSE-C, S3 Lifecycle policies, and CloudWatch Logs.

Answer

Enable SSE-KMS, S3 Versioning with MFA Delete, and S3 Inventory.

Answer

Enable default encryption (SSE-S3), S3 Versioning, and AWS CloudTrail.

Question 4

A company uses AWS KMS to encrypt EBS volumes attached to EC2 instances. The security team wants to ensure that when an EC2 instance is terminated, the associated EBS volume is automatically deleted and the data is unrecoverable. However, the team also needs to retain the volume's data for 90 days for compliance purposes. What is the most secure and cost-effective approach?

Accepted Answer

Before termination, create a snapshot of the volume, copy the snapshot encrypted with a new KMS key, then delete the volume and the original snapshot after 90 days.. Option D is correct because taking a snapshot of the volume before deletion, encrypting it with a different KMS key, and then deleting the volume ensures the data is retained for 90 days and the original volume is unrecoverable. Option A is wrong because disabling the key does not prevent data recovery if a snapshot exists. Option B is wrong because lifecycle manager does not handle deletion. Option C is wrong because it does not preserve data.

Answer

Use Amazon Data Lifecycle Manager to create a snapshot and delete the volume after termination.

Answer

Disable the KMS key used to encrypt the volume, then terminate the instance.

Answer

Configure the EC2 instance with 'DeleteOnTermination' attribute set to true and enable termination protection.

Question 5

A company is using Amazon S3 to store sensitive data. They want to ensure that all objects uploaded to a specific bucket are encrypted using server-side encryption with AWS KMS. Which bucket policy condition should be used to enforce this?

Accepted Answer

Condition: 's3:x-amz-server-side-encryption': 'aws:kms'. Option D is correct because using 's3:x-amz-server-side-encryption' condition with 'aws:kms' enforces that server-side encryption with KMS is used. Option A is wrong because it enforces SSE-S3. Option B is wrong because it enforces SSE-C. Option C is wrong because it checks the KMS key ID but not the encryption method.

Answer

Condition: 's3:x-amz-server-side-encryption-customer-algorithm': 'AES256'

Answer

Condition: 's3:x-amz-server-side-encryption-aws-kms-key-id': 'arn:aws:kms:...'

Answer

Condition: 's3:x-amz-server-side-encryption': 'AES256'

Question 6

A company uses AWS KMS with a custom key store backed by AWS CloudHSM. The security team wants to ensure that the key material never leaves the HSM and that all cryptographic operations are performed within the HSM. Which of the following actions should the team take?

Accepted Answer

Create the KMS key in a custom key store and set the key usage to 'ENCRYPT_DECRYPT'.. Option A is correct because using a custom key store with CloudHSM ensures that KMS operations are performed in the HSM and key material is not exportable. Option B is wrong because symmetric keys do not leave the HSM, but the question asks to ensure it never leaves; custom key store already ensures that. Option C is wrong because asymmetric keys can be exported if the HSM allows. Option D is wrong because disabling key export in KMS is not a direct setting; it's inherent in custom key stores.

Answer

Create the KMS key as an asymmetric key in a custom key store and set the key usage to 'SIGN_VERIFY'.

Answer

Enable the 'Prevent key material export' option in the KMS key policy.

Answer

Create the KMS key as a symmetric key in the default key store.

Question 7

A company uses Amazon RDS for PostgreSQL with encryption at rest enabled using AWS KMS. The security team wants to ensure that database backups (automated snapshots) are also encrypted and that the encryption key can be rotated on demand without re-encrypting the data. Which approach should be taken?

Accepted Answer

Create a new KMS key and modify the RDS instance to use the new key. The existing backup will be re-encrypted with the new key when the instance is modified.. Option B is correct because KMS supports automatic key rotation and manual rotation by creating a new key and updating the RDS instance to use the new key, which re-encrypts the data with the new key. Option A is wrong because RDS does not support importing key material. Option C is wrong because disabling the old key would break access to existing backups. Option D is wrong because RDS does not support using a different key for backups; backups use the same key as the DB instance.

Answer

Use a separate KMS key for backups by enabling 'Copy tags to snapshots' and specifying a different key.

Answer

Disable the old KMS key and enable a new KMS key for the RDS instance. The old backup will remain encrypted with the old key.

Answer

Enable automatic key rotation in KMS and import new key material every 90 days.

Question 8

A company is using Amazon S3 to store confidential documents. They want to ensure that all data is encrypted in transit between the S3 bucket and their on-premises application. Which of the following should be enforced?

Accepted Answer

Add a bucket policy that denies access unless 'aws:SecureTransport' is true.. Option D is correct because 'aws:SecureTransport' condition in a bucket policy enforces HTTPS for all requests. Option A is wrong because SSE only encrypts at rest. Option B is wrong because S3 endpoints use HTTPS by default, but not enforced. Option C is wrong because CloudFront does not enforce encryption to origin.

Answer

Use Amazon CloudFront with a custom origin pointing to the S3 bucket.

Answer

Use a VPC endpoint for S3.

Answer

Enable default encryption (SSE-S3) on the bucket.

Question 9

A company is designing a secure data sharing solution with a third party. The company needs to share sensitive files stored in an S3 bucket with the third party, ensuring that the files are encrypted at rest and in transit, and that the third party can only access specific files. The company also wants to rotate the access credentials every 30 days. Which TWO actions should the company take? (Select TWO.)

Accepted Answer

Configure an S3 bucket policy that denies access unless the request includes a specific KMS key ID.. Options A and D are correct. Using a KMS key policy to grant decrypt permission to the third party's AWS account allows them to decrypt objects. Using S3 bucket policy with a condition on the KMS key ensures they only access objects encrypted with that key. Option B is wrong because presigned URLs can be shared, but they don't enforce encryption key control. Option C is wrong because cross-account roles require the third party to assume a role, not rotate credentials every 30 days. Option E is wrong because using a separate bucket with replication does not enforce key-specific access.

Answer

Create an IAM role in the company's account that the third party can assume, and attach a policy that grants access to the specific files.

Answer

Use S3 Cross-Region Replication to replicate the files to a bucket in the third party's account.

Answer

Generate presigned URLs for the specific files and email them to the third party.

Question 10

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to detect any attempts to use a KMS key that has been disabled. Which THREE steps should the team take to achieve this? (Select THREE.)

Accepted Answer

Enable AWS CloudTrail trails for the account to log KMS events.. Options A, D, and E are correct. Enabling CloudTrail trails (A) captures KMS API calls. Creating a CloudWatch Events rule for 'KMS KeyDisabled' (D) triggers on the event. Configuring an SNS notification (E) sends alerts. Option B is wrong because KMS key rotation does not generate an event. Option C is wrong because disabling key rotation does not detect key usage.

Answer

Configure automatic KMS key rotation to generate daily events.

Answer

Disable key rotation to prevent key material changes.

Question 11

A company is storing sensitive data in Amazon S3. They want to ensure that all data is encrypted at rest using server-side encryption. Which THREE options are available for server-side encryption in S3? (Select THREE.)

Accepted Answer

SSE-KMS. Options A, B, and C are correct. SSE-S3, SSE-KMS, and SSE-C are the three server-side encryption options. Option D is wrong because client-side encryption is not server-side. Option E is wrong because AWS CloudHSM is a service for hardware security modules, not an S3 encryption option.

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 12

A company is migrating its on-premises data warehouse to AWS. The data includes highly sensitive customer financial information. The company has the following requirements: 1) All data must be encrypted at rest using a key that is managed by the company's internal security team. 2) The encryption keys must be rotated every 90 days. 3) The data warehouse must support SQL queries and be highly available across multiple Availability Zones. 4) The solution must minimize the administrative overhead of managing keys. The security team has chosen Amazon Redshift as the data warehouse. They have enabled encryption using AWS KMS with a customer-managed key (CMK). They have set the key rotation period to 90 days using automatic key rotation. However, during a security review, an auditor points out that the key material is still stored in AWS KMS, and the company wants the key material to be stored in a hardware security module (HSM) that they control. Which of the following is the BEST course of action to meet the auditor's requirement while maintaining the other requirements?

Accepted Answer

Create a custom key store in AWS KMS backed by an AWS CloudHSM cluster, and use a KMS key in that custom key store to encrypt the Redshift cluster.. Option C is correct because using a custom key store backed by AWS CloudHSM allows the company to store key material in their own HSM, and automatic key rotation can still be used (though manual rotation may be needed depending on the HSM). Redshift supports encryption with KMS, including custom key stores. Option A is wrong because SSE-C is for S3, not Redshift. Option B is wrong because Redshift does not support CloudHSM directly; it requires KMS custom key store. Option D is wrong because importing key material does not allow the company to control the HSM; the key material is still stored in KMS.

Answer

Use AWS CloudHSM directly to generate and manage the encryption keys, and configure Redshift to use those keys via the CloudHSM client.

Answer

Switch to using Amazon S3 server-side encryption with customer-provided keys (SSE-C) and use Redshift Spectrum to query the data.

Answer

Generate the key material on-premises and import it into KMS as a customer-managed key, then use that key for Redshift encryption.

Question 13

A company is migrating sensitive data to Amazon S3. They need to ensure that data is encrypted at rest using an AWS KMS customer managed key (CMK). The security team wants to enforce encryption for all new objects uploaded to an S3 bucket. Which policy should be attached to the bucket?

Accepted Answer

A bucket policy with a condition that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws:kms header. Option A uses a condition to deny PutObject if encryption is not set, which enforces encryption. Option B only audits, C is too permissive, D allows unencrypted uploads.

Answer

A bucket policy that allows s3:PutObject only if the user has KMS permissions

Answer

An S3 bucket default encryption setting with AES256

Answer

An S3 Lifecycle policy to transition objects to Glacier after 30 days

Question 14

A security engineer is troubleshooting an issue where an Amazon RDS for MySQL DB instance encrypted at rest with AWS KMS is failing to launch. The error message indicates a KMS access issue. Which IAM role or policy is most likely missing?

Accepted Answer

The AWSServiceRoleForRDS service-linked role is missing. The AWSServiceRoleForRDS service-linked role is required for RDS to call AWS KMS on your behalf to manage encryption keys for encrypted DB instances. If this role is missing, RDS cannot obtain the necessary permissions to decrypt the KMS key during instance launch, resulting in a KMS access error. This role is automatically created the first time you create an RDS resource, but if it was deleted or not present, you must recreate it to resolve the issue.

Answer

The RDS subnet group is in a private subnet without a NAT gateway

Answer

The DB instance's security group does not allow outbound traffic to KMS

Answer

The KMS key policy does not grant access to the root account

Question 15

A company uses AWS CloudHSM to store encryption keys for a custom database encryption application. The application runs on Amazon EC2 instances and uses the PKCS#11 library to communicate with the HSM. Recently, the application started failing with 'CKR_SESSION_HANDLE_INVALID' errors. Which of the following is the most likely cause?

Accepted Answer

The application is not closing sessions properly, causing the HSM to reach the maximum number of open sessions. CloudHSM partitions have a limit on the number of open sessions. If the application does not properly close sessions, it can exhaust the limit, causing invalid session handle errors. Option C identifies this. Option A would cause different errors, B is about connectivity, D is about certificates.

Answer

The client certificate used for mutual TLS authentication has expired

Answer

The security group for the HSM does not allow inbound traffic from the EC2 instance

Answer

The HSM's firmware version is incompatible with the PKCS#11 library