SCS-C02 Data Protection Practice Test 9 — 15 Questions

Question 1

A company wants to protect data in transit between its on-premises network and Amazon VPC using IPsec VPN. Which AWS service should be used to establish this VPN connection?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN, is correct because it provides IPsec VPN connections between on-premises networks and VPCs. Option A is incorrect because AWS Client VPN is for individual remote users, not site-to-site. Option C is incorrect because AWS Transit Gateway acts as a hub for VPC connections but does not directly provide VPN endpoints; it can be used with Site-to-Site VPN. Option D is incorrect because AWS Direct Connect provides a dedicated physical connection, not an IPsec VPN.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 2

A company stores sensitive documents in an S3 bucket. The security team wants to ensure that any object uploaded to the bucket is automatically encrypted using server-side encryption with AWS KMS. Which S3 bucket feature should be configured?

Accepted Answer

Default encryption. S3 bucket default encryption can be configured to enforce server-side encryption using AWS KMS (SSE-KMS) for all objects uploaded to the bucket. Option B is incorrect because versioning maintains multiple object versions but does not enforce encryption. Option C is incorrect because bucket policies control access permissions, not encryption settings. Option D is incorrect because lifecycle policies manage object transitions and expiration, not encryption enforcement.

Answer

Versioning

Answer

Bucket policy

Answer

Lifecycle policy

Question 3

A company is using AWS KMS with a customer managed key for encrypting EBS volumes. The security team wants to ensure that only specific IAM roles can use the key for encryption and decryption. What is the best way to achieve this?

Accepted Answer

Attach a resource-based policy (key policy) to the KMS key that allows the specific IAM roles.. KMS key policies can directly specify IAM roles as principals, providing fine-grained access to the key. Option B is incorrect: KMS grants are intended for temporary or delegated access, not for permanent role-based control. Option C is incorrect: Service Control Policies (SCPs) apply at the organizational level and cannot grant access to specific IAM roles for a particular KMS key. Option D is incorrect: While IAM policies require the key policy to enable IAM policy access, the most secure and direct method is to use a key policy that explicitly lists the allowed roles, rather than relying on a combination of IAM and key policies.

Answer

Create a KMS grant that allows the roles to use the key.

Answer

Use an SCP to allow only those roles to use the key.

Answer

Use an IAM policy that grants kms:Encrypt and kms:Decrypt to the roles, and ensure the key policy enables IAM policy access.

Question 4

A company is designing a data protection strategy for its Amazon S3 buckets. Which TWO actions can help protect data from accidental deletion or overwrite?

Accepted Answer

Enable MFA Delete on the bucket.. The correct answers are A and D. MFA Delete (A) adds an extra authentication step to prevent unauthorized deletion. Versioning (D) allows recovery of overwritten or deleted objects by preserving previous versions. Options B, C, and E do not protect against accidental deletion: Cross-Region Replication (B) provides disaster recovery, default encryption (C) protects data at rest, and lifecycle policies (E) can actually delete objects.

Answer

Enable Cross-Region Replication.

Answer

Enable default encryption.

Answer

Set a lifecycle policy to expire objects.

Question 5

A company is using AWS Key Management Service (KMS) with a customer managed key. The security team needs to ensure that the key can be rotated automatically every year. Which TWO steps are required?

Accepted Answer

Enable automatic key rotation in the KMS console or API.. The correct answers are B and E. Option B: Automatic key rotation can be enabled in the KMS console or API for customer managed keys. Option E: The key must be a customer managed key (CMK) because automatic rotation is not available for AWS managed keys. Option A is incorrect because CloudTrail is not required for rotation. Option C is incorrect because key material must be generated by AWS KMS (not imported) for automatic rotation, but this is a prerequisite, not a separate step. Option D is incorrect because the KMS service principal does not need permission to rotate the key.

Answer

Enable AWS CloudTrail for the KMS key.

Answer

Ensure the key material is generated by AWS KMS, not imported.

Answer

Grant the KMS service principal permission to rotate the key.

Question 6

A company needs to protect data in transit between an on-premises data center and AWS. Which THREE services can be used to encrypt data in transit?

Accepted Answer

HTTPS. The correct answers are C (HTTPS), D (AWS Site-to-Site VPN), and E (AWS Certificate Manager (ACM)). HTTPS encrypts web traffic using TLS. AWS Site-to-Site VPN creates an IPsec VPN tunnel to encrypt all traffic between on-premises and AWS. AWS Certificate Manager (ACM) provisions and manages TLS certificates used to encrypt data in transit. Option A (AWS KMS) manages encryption keys for data at rest, not in transit. Option B (AWS Shield) protects against DDoS attacks, not data encryption.

Answer

AWS Key Management Service (KMS)

Answer

AWS Shield

Question 7

A company is storing sensitive customer data in Amazon S3. The security team requires that all data be encrypted at rest using a key that is rotated automatically every year. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use SSE-S3. (SSE-S3) is correct because it uses Amazon S3-managed keys that are automatically rotated by AWS every year, meeting the encryption and rotation requirements with zero operational overhead. Option A (SSE-C) is wrong because the customer manages the keys and must handle rotation manually or not at all. Option C (SSE-KMS) can use automatic key rotation, but it requires creating a KMS key and managing permissions, adding more overhead than SSE-S3. Option D (client-side encryption) requires the customer to implement encryption logic and key management, which adds significant operational complexity.

Answer

Use SSE-C with an AWS-managed key

Answer

Use SSE-KMS with automatic key rotation

Answer

Use client-side encryption with a custom key

Question 8

A company uses AWS KMS to encrypt data in Amazon RDS. The security team discovers that a developer accidentally deleted a customer master key (CMK) used for RDS encryption. What is the impact on the RDS instances that were encrypted with that key?

Accepted Answer

The RDS instances will become inaccessible and data will be lost. When a Customer Master Key (CMK) is deleted in AWS KMS, the encrypted RDS instances become permanently inaccessible and the data is lost. AWS KMS enforces a waiting period (default 7-30 days) before deletion, but once the key is deleted, decryption is impossible. Option B is incorrect because although key deletion is reversible during the waiting period, after deletion the data is lost. Option C is incorrect because automatic re-encryption is not possible without the original key. Option D is incorrect because the instances cannot operate normally without access to the encryption key.

Answer

The key deletion can be reversed within 30 days

Answer

The RDS instances will be automatically re-encrypted with a new key

Answer

The RDS instances will continue to operate normally

Question 9

A company wants to ensure that all data transferred between its on-premises data center and AWS is encrypted in transit. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN. This service provides an encrypted tunnel between on-premises networks and AWS VPCs using IPsec. Option A: Amazon CloudFront is a content delivery network (CDN) and does not provide site-to-site encryption. Option B: AWS Transit Gateway is a network transit hub for interconnecting VPCs and on-premises networks but does not itself provide encryption; it can be used with VPN or Direct Connect. Option C: AWS Direct Connect provides a dedicated private connection but does not encrypt traffic by default; encryption can be added with IPsec or VPN.

Answer

Amazon CloudFront

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 10

A company stores data in Amazon S3 and wants to ensure that objects are encrypted at rest. The security team decides to use server-side encryption with AWS KMS (SSE-KMS). Which additional benefit does SSE-KMS provide over SSE-S3?

Accepted Answer

Separate permissions for key usage and audit of key usage. SSE-KMS provides separate permissions for key usage and allows auditing of key usage via AWS CloudTrail. Option A is incorrect because both SSE-S3 and SSE-KMS use the same AES-256 encryption algorithm for encryption and decryption. Option B is incorrect because SSE-KMS incurs additional costs for KMS API calls, making it more expensive per object than SSE-S3. Option D is incorrect because both options use the same strong encryption algorithm (AES-256).

Answer

Faster encryption and decryption

Answer

Lower cost per object

Answer

Stronger encryption algorithm

Question 11

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team needs to ensure that automated backups are also encrypted. How can this be achieved?

Accepted Answer

Enable encryption at rest on the RDS instance; backups are automatically encrypted. Enabling encryption at rest on the RDS instance automatically encrypts backups. Option A is incorrect because manual encryption of backups is not required and is not practical. Option C is incorrect because RDS does not support Copy-on-Write for encrypting backups. Option D is incorrect because simply storing backups in an encrypted S3 bucket does not encrypt the backup files unless they are encrypted at rest by RDS.

Answer

Manually encrypt each backup using AWS KMS before storing in S3

Answer

Use RDS Copy-on-Write to encrypt backups

Answer

Create an encrypted S3 bucket and store backups there

Question 12

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team needs to ensure high availability and durability of the keys. Which architecture should be recommended?

Accepted Answer

Deploy a CloudHSM cluster with at least two HSMs in different Availability Zones. Deploying a CloudHSM cluster with at least two HSMs in different Availability Zones ensures high availability and durability by eliminating a single point of failure and providing redundancy across AZs. Option A is incorrect because AWS KMS is a different service and does not provide the same hardware-based key generation and storage as CloudHSM. Option B is incorrect because a single CloudHSM instance in one AZ is a single point of failure. Option C is incorrect because CloudHSM does not automatically replicate data across regions; cross-region replication requires manual backup and restore processes.

Answer

Use AWS KMS instead of CloudHSM for better durability

Answer

Deploy a single CloudHSM instance in one Availability Zone

Answer

Deploy CloudHSM in two AWS Regions with automatic replication

Question 13

A company is designing a data lake on Amazon S3 and needs to encrypt data at rest. The compliance team requires that the encryption keys be managed by the company and not by AWS. Which encryption option should be used?

Accepted Answer

SSE-C. (SSE-C) is correct because SSE-C allows the customer to provide their own encryption keys, meeting the compliance requirement that keys be managed by the company and not by AWS. Option B (SSE-S3) is incorrect because AWS manages the keys. Option D (SSE-KMS) is incorrect because even with customer-managed keys, AWS KMS stores and manages the keys. Option C (client-side encryption) is not server-side encryption and would require the customer to manage encryption before upload, but the question specifically asks for encryption at rest on S3, and server-side options are appropriate; SSE-C is the only server-side option where AWS does not manage the keys.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 14

A company is designing a disaster recovery plan for encrypted Amazon EBS volumes. Which THREE steps are required to ensure that encrypted EBS snapshots can be restored in a different AWS Region?

Accepted Answer

Copy the encrypted snapshot to the target AWS Region. To restore encrypted EBS snapshots in a different AWS Region, you must copy the encrypted snapshot to the target region (B) and ensure the customer managed key (CMK) used for encryption is available in the target region (D). Re-encrypting the snapshot with a CMK in the target region (A) is optional if you want to use a different key, but it is not a required step. Options C and E are incorrect because AWS CloudHSM is not used for EBS encryption and sharing snapshots via AWS RAM does not guarantee key availability.

Answer

Re-encrypt the snapshot with a customer managed key (CMK) in the target region

Answer

Store the encryption key in AWS CloudHSM in the target region

Answer

Share the snapshot with the target region using AWS RAM

Question 15

A company wants to protect sensitive data in Amazon S3 from unauthorized access. Which TWO AWS services can be used to detect and alert on suspicious access patterns?

Accepted Answer

AWS CloudTrail. Options A and E are correct. Amazon Macie uses machine learning to discover, classify, and protect sensitive data in S3, and it can alert on suspicious access patterns. AWS CloudTrail logs all API calls to S3, which can be analyzed to detect unauthorized access. Option B (AWS Config) is incorrect because it assesses compliance and tracks configuration changes but does not focus on data access patterns. Option C (Amazon CloudWatch Logs) is incorrect because while it can store S3 access logs, it does not inherently analyze for suspicious patterns without additional services like CloudWatch Logs Insights. Option D (Amazon GuardDuty) is incorrect because although it detects threats across AWS accounts, it is not specifically for S3 data access patterns; its primary focus is on network and account-level threats.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty