SCS-C02 Data Protection Practice Test 9 — 15 Questions

Question 1

A company uses S3 Server Access Logs to audit access to their S3 buckets. The security team wants to ensure that the log files themselves are encrypted at rest using SSE-KMS. Which configuration step is necessary?

Accepted Answer

Add a bucket policy on the destination bucket that grants the S3 log delivery service permission to use the KMS key. To encrypt S3 access logs with SSE-KMS, the bucket policy of the destination bucket must allow the S3 log delivery service to use the KMS key. Option A is correct. Option B is about the source bucket, C is unnecessary, D is about server-side encryption for the source bucket.

Answer

Use an S3 bucket policy to deny unencrypted uploads to the source bucket

Answer

Enable default encryption on the source bucket

Answer

Configure the destination bucket with a lifecycle policy

Question 2

A company is designing a data protection strategy for Amazon EBS volumes. They want to automate the creation of point-in-time snapshots for all production volumes and retain them for 90 days. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use Amazon Data Lifecycle Manager (DLM) to create a policy that takes snapshots daily and retains them for 90 days. Amazon Data Lifecycle Manager (DLM) is designed to automate EBS snapshot creation and retention. Option A is correct. Option B is manual, C is for backups (though DLM also works), D is third-party overhead.

Answer

Write a script using the AWS CLI that creates snapshots and runs on a schedule via cron on an EC2 instance

Answer

Use an AWS Lambda function triggered by CloudWatch Events to create snapshots and delete old ones

Answer

Use AWS Backup to create a backup plan for EBS volumes with a 90-day retention

Question 3

Refer to the exhibit. A security engineer is troubleshooting why an IAM user (Alice) cannot encrypt data using a KMS key. Alice has full S3 and KMS permissions via an IAM policy. The key policy is shown. Which statement explains the issue?

Accepted Answer

The key policy does not allow the IAM user to use the key for any action. The key policy only grants kms:Put* and kms:Create* to the Admin role, not to Alice. Since the key policy does not allow Alice's actions, the IAM policy alone is insufficient because KMS requires key policy to grant access unless the key policy allows IAM policies. Option C correctly identifies the missing kms:Encrypt permission. Option A is incorrect because root is allowed; B is wrong because the key policy is restrictive; D is wrong because Alice has IAM permissions but key policy doesn't allow them.

Answer

The key policy is missing a statement to allow the IAM user to use the key via IAM policies

Answer

The IAM user does not have the kms:Encrypt permission in their IAM policy

Answer

The key policy does not include the root account principal

Question 4

A company wants to protect data in transit between an on-premises data center and Amazon S3. Which AWS service should be used to establish a dedicated, encrypted connection?

Accepted Answer

AWS Direct Connect with an IPsec VPN. AWS Direct Connect with VPN provides a dedicated private connection with encryption. Option A is correct. Option B is for site-to-site VPN over internet, C is for transit, D is private connection without encryption by default.

Answer

AWS Direct Connect without VPN

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN over the internet

Question 5

A company uses Amazon S3 to store sensitive documents. The security policy requires that all objects be encrypted with server-side encryption using customer-provided encryption keys (SSE-C). A developer uploads objects using the AWS SDK but forgets to include the encryption key in the request. What happens to the upload?

Accepted Answer

The upload succeeds but the object is stored without server-side encryption. With SSE-C, the request must include the encryption key. If not provided, the upload succeeds but the object is stored without server-side encryption (i.e., as plaintext). Option C is correct. Option A is wrong because S3 does not deny; B is wrong because no error; D is wrong because default encryption is not applied.

Answer

The upload succeeds and the object is encrypted with the default S3 managed key

Answer

The upload succeeds and the object is encrypted with the bucket's default encryption settings

Answer

The upload fails with a 400 Bad Request error

Question 6

A company is using AWS KMS to encrypt data in Amazon Redshift. They need to rotate the KMS key annually. Which approach meets the requirement with minimal operational impact?

Accepted Answer

Enable automatic key rotation on the KMS key. Option C is correct because AWS KMS supports automatic annual key rotation for customer-managed KMS keys. Enabling this feature automatically rotates the key material once per year with no manual intervention, minimal operational overhead, and no impact on the Redshift cluster, which continues to use the same key ID.

Answer

Create a new KMS key each year and update the Redshift cluster to use the new key

Answer

Use an AWS Lambda function to rotate the key every year

Answer

Rotate the key by re-importing key material into an existing KMS key

Question 7

Refer to the exhibit. A security engineer applies the bucket policy to an S3 bucket. A user uploads an object without specifying any encryption header. What happens?

Accepted Answer

The request is denied with an Access Denied error. The policy denies PutObject when the encryption header is not equal to 'aws:kms'. Since the user did not specify the header, the condition evaluates to true (the header is not equal to 'aws:kms'), and the request is denied. Option A is correct. Option B is wrong because default encryption is not applied; C is wrong because even with default SSE-S3, the header is not 'aws:kms'; D is wrong because the policy denies.

Answer

The object is uploaded and encrypted with the bucket's default SSE-S3

Answer

The object is uploaded and encrypted with SSE-KMS

Answer

The object is uploaded without encryption

Question 8

A company uses Amazon DynamoDB with client-side encryption using AWS KMS. The application is experiencing high latency on write operations. Which change is most likely to reduce latency?

Accepted Answer

Cache the data key locally and reuse it for multiple items. Option D is correct because client-side encryption with AWS KMS typically involves calling the KMS GenerateDataKey API to obtain a data key, which is then used to encrypt items locally. Each KMS API call adds network latency. By caching the data key locally and reusing it for multiple items, you eliminate repeated KMS round trips, significantly reducing per-write latency. This is a well-known optimization for client-side encryption patterns.

Answer

Switch to server-side encryption with KMS

Answer

Increase the provisioned write capacity of the table

Answer

Use DynamoDB Accelerator (DAX)

Question 9

A company is designing a data protection strategy for Amazon S3. Which TWO of the following are valid methods to protect data at rest in S3?

Accepted Answer

Server-side encryption with S3-managed keys (SSE-S3). Server-side encryption with S3-managed keys (SSE-S3) encrypts data at rest using AES-256, with Amazon S3 managing the encryption/decryption process and key rotation automatically. This is a valid method to protect data at rest in S3 because it ensures objects are encrypted before being written to disk and decrypted when accessed, without requiring any additional client-side logic or key management overhead.

Answer

S3 Versioning

Answer

S3 bucket policies

Answer

MFA Delete

Question 10

A security engineer is configuring a new AWS KMS customer managed key. Which THREE of the following are required components of a KMS key policy?

Accepted Answer

A statement that grants key usage permissions to specific IAM users or roles. A KMS key policy must have a statement that allows the AWS account to use IAM policies for access (Option A), and typically specifies key administrators (Option B) and key users (Option C). Option D is optional for automatic rotation, E is for aliases not required.

Answer

A statement that defines the key alias

Answer

A statement that enables automatic key rotation

Question 11

A company uses AWS CloudTrail to log API calls. They want to ensure that log files are encrypted at rest and that integrity is verified. Which TWO services can be used together to achieve this?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation (option C) provides a built-in mechanism to verify that log files have not been modified, deleted, or tampered with after delivery. It uses SHA-256 hashing and digital signatures (based on RSA) to create a digest file that can be independently validated. AWS KMS (option D) allows you to encrypt CloudTrail log files at rest using server-side encryption (SSE-KMS), ensuring that the logs are stored in an encrypted format. Together, they meet both the encryption-at-rest and integrity verification requirements.

Answer

S3 Inventory

Answer

AWS CloudHSM

Answer

S3 MFA Delete

Question 12

A financial services company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application processes credit card numbers and stores them in an Amazon RDS for PostgreSQL database. The database is encrypted at rest using AWS KMS. The security team is concerned about data in transit between the ALB and EC2 instances, and between EC2 and RDS. They also want to ensure that the application never logs the full credit card number. The current setup: ALB terminates SSL using a certificate from AWS Certificate Manager (ACM). EC2 instances are in a private subnet. RDS is in a private subnet. The application logs to CloudWatch Logs. The security team reviews the logs and finds full credit card numbers in the logs. Which of the following actions should the security engineer take to address the data protection issues?

Accepted Answer

Modify the application to use TLS when connecting to RDS and update the application code to mask or truncate credit card numbers before logging. Option D is the best because it addresses both encryption in transit (using TLS between EC2 and RDS) and logging (masking credit cards in application code). Option A only adds encryption in transit but does not fix logging. Option B is about retention, not protection. Option C is about encryption at rest, not in transit or logging.

Answer

Create a CloudWatch Logs subscription filter to redact credit card numbers from the logs after they are sent to CloudWatch

Answer

Enable RDS encryption with a new KMS key and enforce that all connections to RDS use SSL

Answer

Enable encryption in transit between the ALB and EC2 by using HTTPS listeners and configure the ALB to re-encrypt traffic to EC2 using a self-signed certificate on each instance

Question 13

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team wants to ensure that only users with a specific IAM role can decrypt objects. What is the MOST secure way to achieve this?

Accepted Answer

Use a customer managed KMS key with a key policy that grants kms:Decrypt only to the specific IAM role, and configure the S3 bucket policy to allow only that role to access the bucket.. Option C is correct because using a KMS key with a key policy that grants decrypt only to the specific IAM role ensures that only that role can decrypt, while the bucket policy restricts who can access the bucket. Option A is wrong because the bucket policy alone cannot control decryption. Option B is wrong because S3 default encryption does not restrict decryption. Option D is wrong because KMS automatic key rotation does not control access.

Answer

Enable automatic key rotation in KMS and assign the key to the IAM role.

Answer

Configure an S3 bucket policy that denies all users except the specific IAM role.

Answer

Use S3 default encryption with an AWS managed key and trust the IAM role.

Question 14

A company is designing a data protection strategy for its Amazon RDS for PostgreSQL database. The database contains sensitive customer data. Compliance requirements mandate that all backups be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance using a customer managed KMS key. Enable automatic key rotation in KMS.. Option A is correct because enabling encryption on the RDS instance uses KMS, and manual snapshots inherit the same KMS key. Key rotation can be enabled in KMS. Option B is wrong because AWS managed keys cannot be rotated on a custom schedule; they rotate automatically every year, but the customer cannot control the rotation. Option C is wrong because S3 server-side encryption does not apply to RDS backups. Option D is wrong because enabling encryption on a read replica does not encrypt the source instance backups.

Answer

Create an encrypted read replica of the RDS instance and use the replica for backups.

Answer

Use S3 server-side encryption with a customer managed key for automated backups. Configure lifecycle policies to rotate the key.

Answer

Enable encryption at rest on the RDS instance using an AWS managed KMS key. The key will be rotated automatically every year.

Question 15

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The application runs on Amazon EC2 instances and uses the PKCS#11 interface to interact with the HSM. The security team recently discovered that a former employee may have obtained a copy of the cryptographic materials from the HSM. What should the security team do to minimize the impact?

Accepted Answer

Delete the CloudHSM backup from the backup service. Then rotate all keys that were stored in the HSM.. Option C is correct because CloudHSM backup contains the cryptographic material; deleting the backup ensures the former employee cannot restore the HSM's contents. Option A is wrong because deleting the HSM cluster does not delete the backup automatically. Option B is wrong because changing the HSM credentials does not invalidate the copied material. Option D is wrong because KMS cannot revoke keys stored in CloudHSM.

Answer

Use AWS KMS to create a new key and re-encrypt all data. Then revoke the old key.

Answer

Change the HSM administrator password and the crypto user passwords.

Answer

Delete the HSM cluster and create a new one. Restore the backup from a known good time.