SCS-C02 Data Protection Practice Test 9 — 15 Questions

Question 1

A company wants to protect sensitive data in Amazon S3 by ensuring that all objects are encrypted at rest. Which TWO options meet this requirement? (Choose TWO.)

Accepted Answer

Use server-side encryption with S3 managed keys (SSE-S3). Options A and D are correct because they are server-side encryption methods provided by S3 to encrypt objects at rest. SSE-S3 uses S3-managed keys, while SSE-KMS uses AWS KMS keys. Option B (SSL/TLS) protects data in transit, not at rest. Option C (client-side encryption) encrypts data before upload, but it is not an S3 server-side encryption feature and does not rely on S3 for encryption key management; thus it does not meet the requirement of S3 ensuring encryption at rest. Option E (Amazon Macie) is a data classification and discovery service, not an encryption mechanism.

Answer

Use SSL/TLS for data in transit

Answer

Use client-side encryption with the AWS Encryption SDK

Answer

Use Amazon Macie to classify and mask data

Question 2

A company uses Amazon S3 to store sensitive documents. The security engineer notices that an S3 bucket named 'documents-prod' has been configured with a bucket policy that allows s3:PutObject from any principal, but only if the request includes the x-amz-server-side-encryption header set to 'AES256'. The company's security policy requires that all objects be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). The engineer needs to ensure that any new objects uploaded to the bucket are encrypted with SSE-KMS, and that existing objects remain accessible. What should the engineer do?

Accepted Answer

Update the bucket policy to require the x-amz-server-side-encryption header set to 'aws:kms' and specify the desired KMS key ARN. The bucket policy currently only enforces AES256 (SSE-S3). To require SSE-KMS, the policy condition must be updated to require the x-amz-server-side-encryption header to equal 'aws:kms' and to specify the KMS key ARN via s3:x-amz-server-side-encryption-aws-kms-key-id. This denies any PutObject that does not use the approved KMS key, while leaving existing objects untouched and accessible.

Answer

Create a new bucket with a bucket policy that requires SSE-KMS, and migrate all objects using S3 Batch Operations

Answer

Modify the bucket's default encryption configuration to use SSE-KMS

Answer

Enable S3 Object Lock on the bucket to prevent overwrites, and use a lifecycle policy to expire objects that are not encrypted with SSE-KMS

Question 3

A company uses Amazon RDS for MySQL to store customer data. The security team wants to ensure that the database is encrypted at rest. The database is already running and contains production data. The team needs to enable encryption at rest with minimal downtime. What should they do?

Accepted Answer

Create a read replica with encryption enabled, promote it to a standalone instance, and update the application connection string. You cannot enable encryption on an existing RDS instance; you must create a new encrypted instance and migrate. Option B is wrong because you cannot modify the existing instance to add encryption. Option C is wrong because snapshots can be encrypted, but you still need to restore to a new instance. Option D is wrong because you cannot attach encrypted storage.

Answer

Attach an encrypted EBS volume to the RDS instance

Answer

Take a snapshot of the database, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new instance

Answer

Modify the existing DB instance and enable encryption using the AWS CLI

Question 4

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which policy configuration should be used?

Accepted Answer

Add a bucket policy with a condition that the kms:ViaService is s3.amazonaws.com. The bucket policy can include a condition using the kms:ViaService condition key set to s3.amazonaws.com, which ensures that decryption requests must come through S3. This allows only requests that originate from S3 (e.g., when the IAM role accesses the bucket) to decrypt, provided the role also has kms:Decrypt permission. Option A is incorrect because S3 access point policies control access to the access point, not KMS decryption. Option B is incorrect because source IP conditions do not restrict decryption to S3; they restrict based on IP address, which is not the requirement. Option C is incorrect because a KMS grant is typically used to delegate temporary access to another AWS principal, not to restrict a specific IAM role; a key policy with a principal condition is more appropriate.

Answer

Use an S3 access point policy to restrict access

Answer

Attach an IAM policy to the role that allows kms:Decrypt with a condition on the source IP

Answer

Create a KMS grant for the IAM role with Decrypt permission

Question 5

A financial services company must ensure that all data written to Amazon S3 is encrypted at rest and that the encryption keys are rotated every 90 days. The company also needs to maintain an audit trail of when keys were used. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use SSE-C with customer-provided keys and rotate keys using a Lambda function. (SSE-C with customer-provided keys and rotate keys using a Lambda function) is correct because it allows the company to enforce a 90-day key rotation schedule by using a custom Lambda function, which meets the requirement with relatively low operational overhead compared to fully manual solutions. SSE-C provides encryption at rest, and key usage can be audited via S3 server access logs and CloudTrail. Option A (SSE-S3) is incorrect because it does not support customer-controlled key rotation. Option C (SSE-KMS with automatic key rotation) is incorrect because automatic rotation occurs only once per year (365 days), not every 90 days as required. Option D (client-side encryption with the AWS Encryption SDK) is incorrect because it requires custom key management and rotation, increasing operational overhead.

Answer

Use SSE-S3 with default encryption enabled

Answer

Use SSE-KMS with a customer managed key and enable automatic key rotation

Answer

Use client-side encryption with the AWS Encryption SDK

Question 6

A company stores sensitive data in Amazon S3. The security team needs to ensure that data is encrypted at rest and that access is logged. Which TWO actions meet these requirements?

Accepted Answer

Enable S3 server access logs. Option D (Enable default encryption on the S3 bucket) is correct because S3 default encryption (SSE-S3 or SSE-KMS) ensures all objects stored in the bucket are encrypted at rest automatically, satisfying the encryption requirement. Option B (Enable S3 server access logs) is correct because S3 server access logs record detailed requests made to the bucket, including the requester, bucket name, request time, and operation, which fulfills the access logging requirement. Option A (VPC Flow Logs) only captures IP traffic metadata for network interfaces in a VPC and does not log S3 object-level access or provide encryption. Option C (CloudTrail data events) can log S3 object-level API activity, but it is not the action marked correct here and does not itself provide encryption at rest. Option E (IAM Access Analyzer) identifies resources shared with external entities and does not encrypt data or log access.

Answer

Enable VPC Flow Logs for the VPC

Answer

Enable AWS CloudTrail to log data events

Answer

Enable AWS IAM Access Analyzer

Question 7

A company is using Amazon RDS for PostgreSQL with encryption at rest using AWS KMS. The security team wants to ensure that only a specific set of IAM roles can manage the KMS key used for encryption. Which TWO steps should the team take?

Accepted Answer

Attach an IAM policy to the IAM roles that grants kms:Encrypt and kms:Decrypt. To control access to a KMS key used for RDS encryption, two steps are required. First, modify the KMS key policy to grant the specific IAM roles permission to use the key (Option B). Second, attach an IAM policy to those roles that grants the necessary KMS actions, such as kms:Encrypt and kms:Decrypt (Option A). Option C is insufficient because it only grants decryption; both encrypt and decrypt are needed for RDS to use the key. Option D is incorrect because S3 bucket policies are not relevant to KMS key permissions. Option E is incorrect because VPC endpoint policies control network access, not key usage permissions.

Answer

Attach an IAM policy to the IAM roles that grants kms:Decrypt only

Answer

Create an S3 bucket policy to restrict access to the KMS key

Answer

Use a VPC endpoint policy to restrict access to the KMS key

Question 8

A company is migrating on-premises file servers to Amazon EFS. The data must be encrypted at rest and in transit. Which THREE steps should the company take to meet these requirements?

Accepted Answer

Use a KMS customer managed key for encryption at rest. Option A is correct because Amazon EFS encryption at rest is implemented with AWS KMS, and using a customer managed key gives the company control over the key policy, rotation, and audit trail rather than relying on the default aws/elasticfilesystem key. Option E is correct because encryption at rest must be enabled when the EFS file system is created; this setting cannot be changed afterward, so the company must turn it on during the migration's file system provisioning. Option D is correct because EFS supports encryption in transit via TLS, and clients mount the file system using the TLS mount option (for example, with the amazon-efs-utils mount helper using -o tls) to protect data as it moves between the mount target and the client. Option B is not needed because AWS Certificate Manager issues certificates for services like ELB and CloudFront, not for EFS, and EFS handles TLS transparently without a customer-supplied certificate. Option C is incorrect because you cannot install an SSL certificate on an EFS file system; EFS is a managed service and TLS for in-transit encryption is enabled through the mount configuration, not by uploading certificates to the file system.

Answer

Use AWS Certificate Manager to issue a certificate

Answer

Install an SSL certificate on the EFS file system

Question 9

A company has an AWS Lambda function that processes sensitive data and writes the results to an Amazon S3 bucket. The security team requires that the data is encrypted at rest in S3 and that the Lambda function has the minimum permissions necessary. Which THREE actions should the team take?

Accepted Answer

Enable default encryption on the S3 bucket with SSE-KMS. Option A is correct because enabling default encryption on the S3 bucket with SSE-KMS ensures all objects written by the Lambda function are encrypted at rest using AWS KMS-managed keys, satisfying the security team's encryption requirement. Option D is correct because the KMS key policy must explicitly allow the Lambda execution role to use the key; without this grant, the role's IAM permissions alone are insufficient to access the KMS key for encryption operations. Option E is correct because when using SSE-KMS, the Lambda execution role needs kms:GenerateDataKey to obtain a data key for encrypting objects and kms:Decrypt to read or process the encrypted objects, following least-privilege principles. Option B is not among the correct answers because kms:Encrypt alone is not the permission set required for SSE-KMS object encryption via S3, which relies on GenerateDataKey and Decrypt. Option C is incorrect because kms:CreateKey is an administrative permission that violates least privilege and is not needed by the Lambda execution role to encrypt data.

Answer

Grant the Lambda execution role kms:Encrypt permission

Answer

Grant the Lambda execution role kms:CreateKey permission

Question 10

Refer to the exhibit. An S3 bucket policy is shown. An administrator uploads an object to 'example-bucket' without specifying any encryption header. What is the outcome?

Accepted Answer

The upload fails with an Access Denied error. The bucket policy denies PutObject requests unless the 'x-amz-server-side-encryption' header equals 'AES256'. Since no encryption header was specified, the condition evaluates to true, and the request is denied with an Access Denied error. Options B, C, and D are incorrect because the upload fails due to the policy.

Answer

The object is uploaded and encrypted with the bucket's default encryption settings

Answer

The object is encrypted with SSE-KMS automatically

Answer

The object is uploaded without encryption

Question 11

Refer to the exhibit. A KMS key policy is shown. An IAM role named 'DataProcessor' in account 123456789012 is trying to encrypt data using this key. The role also has an IAM policy that allows kms:Encrypt on the key. Will the encryption succeed?

Accepted Answer

Yes, because the key policy allows the role and the IAM policy also allows. The KMS key policy explicitly allows the IAM role 'DataProcessor' to perform kms:Encrypt, and the role also has an IAM policy granting the same permission. In KMS, when both the key policy and an IAM policy grant access to a principal in the same account, the principal can perform the operation. Option A is incorrect because the IAM policy alone is not sufficient if the key policy does not grant access to the role. Option C is incorrect because no condition is required when the role is in the same account and the key policy already allows it. Option D is incorrect because the role is in the same account (123456789012) as the key, so inter-account authorization is not an issue.

Answer

Yes, because the IAM policy alone is sufficient

Answer

No, because the key policy must include a condition for the role

Answer

No, because the role is in a different account

Question 12

A company is using AWS KMS to encrypt sensitive data in Amazon DynamoDB. The security team wants to ensure that the KMS key can only be used from within the company's VPC and not from the internet. The VPC has an interface VPC endpoint for KMS. What should the security team do to enforce this restriction?

Accepted Answer

Attach a VPC endpoint policy that denies access from outside the VPC. A VPC endpoint policy is an IAM resource policy attached to the interface endpoint (com.amazonaws.<region>.kms) that controls which principals can use the endpoint and under what conditions. By writing a policy that denies requests unless they arrive via the endpoint (e.g., using aws:sourceVpce), the team ensures KMS API calls can only be made from inside the VPC, blocking internet-originated calls. This is the AWS-recommended way to restrict a service to VPC-only access.

Answer

Make the KMS key Regional and disable cross-Region access

Answer

Use security group rules to restrict access to the KMS endpoint

Answer

Create an S3 bucket policy that restricts access to the KMS key

Question 13

A security engineer is designing a data protection strategy for a healthcare application that stores Protected Health Information (PHI) in an S3 bucket. The bucket is accessed by multiple AWS services, including Athena and SageMaker. Which TWO actions should the engineer take to ensure encryption at rest and in transit? (Choose two.)

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3.. Enabling default encryption on the S3 bucket using SSE-S3 encrypts objects at rest. Option E is correct because a bucket policy condition denying requests without aws:SecureTransport enforces encryption in transit. Option B is incorrect because 'using AES-256' is ambiguous; AWS S3 default encryption requires choosing a specific method like SSE-S3, SSE-KMS, or SSE-C. Options C and D are not optimal for S3 encryption at rest.

Answer

Enable S3 bucket default encryption using AES-256.

Answer

Use AWS CloudHSM to generate and store encryption keys for S3.

Answer

Set up Kinesis Data Firehose to encrypt data before writing to S3.

Question 14

A financial services company uses AWS KMS to encrypt sensitive data in S3 and RDS. The security team requires a centralized audit trail of all KMS key usage, including key creation, deletion, and cryptographic operations. The audit logs must be stored in a separate AWS account for compliance. The team has enabled CloudTrail in the management account and configured a trail that logs to an S3 bucket in the audit account. However, they notice that KMS events such as Decrypt and GenerateDataKey are not appearing in the CloudTrail logs. The KMS key policy includes the following statement: {"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::management-account:root"},"Action":"kms:*","Resource":"*"}. What is the MOST likely reason for the missing KMS events?

Accepted Answer

CloudTrail is not configured to log KMS data events.. CloudTrail logs management events (like CreateKey, ScheduleKeyDeletion) by default, but KMS cryptographic operations such as Decrypt, Encrypt, GenerateDataKey, and ReEncrypt are classified as data events and must be explicitly enabled on the trail. Because the trail was only configured for default management events, those KMS data events never reach the audit S3 bucket. Enabling data events for the KMS key (or for all KMS keys) on the trail resolves the missing events.

Answer

The S3 bucket in the audit account does not have a bucket policy allowing writes from CloudTrail.

Answer

CloudTrail does not log KMS Decrypt and GenerateDataKey events.

Answer

The KMS key policy does not grant CloudTrail permission to log events.

Question 15

A startup is building a serverless application using AWS Lambda to process user-uploaded images. The images are stored in an S3 bucket with server-side encryption (SSE-S3) enabled. The Lambda function reads the images, performs transformations, and writes the results to a different S3 bucket. The security engineer wants to ensure that data is encrypted at rest and in transit throughout the pipeline. The Lambda function is configured with an IAM role that has permissions to read from the source bucket and write to the destination bucket. Which additional configuration is REQUIRED to ensure end-to-end encryption?

Accepted Answer

No additional configuration is required; Lambda uses HTTPS by default to call S3.. AWS Lambda uses HTTPS (TLS) by default for all calls to AWS services, including S3, so data in transit is already encrypted. SSE-S3 provides encryption at rest for objects in both source and destination buckets. Therefore, no additional configuration is required to meet the stated encryption requirements.

Answer

Add a bucket policy to the source bucket that denies requests not using aws:SecureTransport.

Answer

Grant the Lambda function's IAM role permission to call KMS Decrypt and Encrypt.

Answer

Enable VPC endpoints for S3 and configure Lambda to use them.