20+ practice questions focused on Data Protection — one of the most tested topics on the AWS Certified Security Specialty SCS-C02 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Data Protection PracticeA company stores sensitive data in Amazon S3 and wants to ensure that all objects are encrypted at rest. The security team has enabled default encryption on the S3 bucket using SSE-S3. However, an audit reveals that some objects are stored with SSE-KMS. How can the company enforce that only SSE-S3 is used for all future uploads, while still allowing existing SSE-KMS objects to be read?
Explanation: It uses a bucket policy to deny s3:PutObject unless the x-amz-server-side-encryption header is set to AES256, which is the value for SSE-S3. This enforces that all future uploads use SSE-S3, while existing SSE-KMS objects remain readable because the policy only applies to write operations. The condition key s3:x-amz-server-side-encryption checks the encryption header value, and the Deny effect overrides any Allow, ensuring compliance.
A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?
Explanation: AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.
A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)
Explanation: Configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.
A company uses S3 to store sensitive customer data. The security team requires that all objects uploaded to S3 be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). A developer reports that some objects are being stored unencrypted. What is the MOST effective way to enforce this requirement?
Explanation: A bucket policy that denies s3:PutObject unless the request specifies SSE-KMS (aws:kms) is the most effective enforcement because IAM/bucket policies are evaluated on every API call and cannot be bypassed by clients. The condition key s3:x-amz-server-side-encryption (or s3:RequestObjectTagKeys style conditions) lets you reject any PutObject that doesn't explicitly request aws:kms encryption. This ensures objects are encrypted with KMS-managed keys rather than merely defaulted to SSE-S3.
A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that when an EC2 instance is launched, the attached EBS volumes are always encrypted using a specific customer managed key. Which action will enforce this?
Explanation: A service control policy (SCP) in AWS Organizations can enforce that ec2:RunInstances is denied unless the EBS volume encryption key matches the required customer managed key. SCPs set the maximum permissions for accounts in an organization, so a deny statement with a condition on the KMS key ID effectively blocks launches that do not use the specified key.
+15 more Data Protection questions available
Practice all Data Protection questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Data Protection. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Data Protection questions on the SCS-C02 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Data Protection is tested as part of the AWS Certified Security Specialty SCS-C02 blueprint. Practicing with targeted Data Protection questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free SCS-C02 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Data Protection is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Data Protection practice session with instant scoring and detailed explanations.
Start Data Protection Practice →