Courseiva

CCNA Data Protection Questions

15 questions · Data Protection · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

An organization wants to rotate their KMS customer-managed keys every 90 days. What is the most effective way to implement this?

A.Modify the KMS key's rotation policy to 90 days.
B.Use an AWS Lambda function to trigger the rotation of the KMS key backing material.
C.Perform manual key rotation by creating a new key every 90 days.
D.Use AWS Secrets Manager to rotate the KMS key every 90 days.
AnswerC

Since automatic rotation is fixed at 365 days, manual rotation is the only way to satisfy a 90-day requirement. This involves creating a new KMS key, updating application references, and retaining the previous key for decryption of legacy data, ensuring compliance with internal security policies.

Why this answer

AWS KMS automatic rotation occurs every 365 days and cannot be configured for a 90-day interval. To meet a 90-day requirement, the organization must perform manual rotation. This involves creating a new key, updating the application's key ID configuration (or using an alias), and keeping the old key active only for decrypting existing data, which is a standard procedure for strict compliance.

Practice this question →
2
Multi-Selectmedium

An organization is using Amazon Macie to protect sensitive data in S3. They want to ensure they are alerted to the presence of PII across all buckets. Which TWO actions are required to configure Macie to identify sensitive data effectively?

Select 2 answers
A.Create a sensitive data discovery job to scan the S3 buckets, specifying the depth and frequency of the analysis.
B.Enable the Macie service-linked role in IAM to allow the service to access and analyze objects in the S3 buckets.
C.Install the Macie agent on all EC2 instances that write data to the S3 buckets to classify data in real-time.
D.Configure S3 Event Notifications to send every new object to a Lambda function that calls the Macie 'ScanObject' API.
E.Enable S3 Object Lock on all buckets to allow Macie to generate findings without the risk of data being deleted during a scan.
AnswersA, B

A discovery job is the mechanism Macie uses to inspect objects in S3. You can configure it to run once or on a recurring basis, and you can define which buckets to include. This job performs the actual analysis of the data against managed or custom data identifiers.

Why this answer

Amazon Macie requires both a discovery job and the proper permissions to analyze data. Discovery jobs allow you to define the scope and frequency of the scan, while the service-linked role ensures Macie has the necessary access to read the objects in your S3 buckets for analysis and classification.

Practice this question →
3
MCQhard

A financial institution requires that all data stored in S3 buckets be immutable for five years to comply with regulatory requirements. They also need to ensure that even the root user cannot delete the data or shorten the retention period. Which configuration should the security engineer implement?

A.Enable S3 Versioning and implement an S3 Lifecycle policy to transition objects to Glacier Deep Archive with a five-year expiration rule.
B.Enable S3 Object Lock on the bucket and set a Default Retention period of five years using Governance mode.
C.Enable S3 Object Lock on the bucket and set a Default Retention period of five years using Compliance mode.
D.Apply a Bucket Policy with a Deny effect on the s3:DeleteObject action for all principals, including a condition that checks the current date.
AnswerC

Compliance mode ensures that an object cannot be deleted or its retention settings modified by any user, including the AWS account root user. This mode is specifically designed for environments where strict data integrity and non-rewriteable, non-erasable storage are required for a fixed period to satisfy legal mandates.

Why this answer

S3 Object Lock in Compliance mode provides the strongest immutability guarantee by preventing any user, including the root user, from deleting objects or reducing the retention period. This is essential for meeting strict regulatory requirements like SEC Rule 17a-4. Using Compliance mode ensures that the protection remains absolute throughout the entire specified duration.

Practice this question →
4
Multi-Selecthard

A security architect is designing a cross-account data sharing solution. Account A owns a KMS Customer Managed Key (CMK) that must be used by an IAM role in Account B to decrypt S3 objects. Which TWO steps are required to enable this cross-account access?

Select 2 answers
A.Modify the KMS key policy in Account A to grant the IAM role in Account B permission to use the key.
B.Attach an IAM policy to the role in Account B that allows the 'kms:Decrypt' action on the Key ARN in Account A.
C.Create a VPC Peering connection between Account A and Account B to allow KMS traffic.
D.Configure the IAM role in Account B to assume a role in Account A that has KMS permissions.
E.Enable 'KMS Multi-Region' support on the key in Account A to allow it to be seen by Account B.
AnswersA, B

The key policy is the primary gatekeeper for a KMS key. For cross-account access, the key policy in the owning account must explicitly allow the external account (or a specific principal in that account) to perform cryptographic operations. Without this explicit grant, AWS identity-based policies in Account B will have no effect.

Why this answer

Cross-account access to a KMS key requires permissions to be granted in two places: the key policy (resource-based) and the IAM policy (identity-based). The key owner must trust the external account in the key policy, and the external account's administrator must then grant specific users or roles permission to use that key.

Practice this question →
5
MCQmedium

A company is implementing a new internal web application and needs to use SSL/TLS certificates. Due to regulatory requirements, the certificates must be issued by a private Certificate Authority (CA) managed by the company, rather than a public CA. Which AWS service should be used to meet this requirement?

A.AWS Private Certificate Authority (AWS Private CA)
B.AWS Certificate Manager (ACM) with public certificates.
C.AWS CloudHSM to store and manage the private keys of the web application.
D.AWS Secrets Manager to store and rotate the SSL/TLS certificates.
AnswerA

AWS Private CA is the correct service for managing a private CA hierarchy. It allows you to issue and revoke certificates that are trusted within your organization but not by the public internet. It integrates with ACM, making it easy to deploy these private certificates to resources like Load Balancers.

Why this answer

AWS Private Certificate Authority (AWS Private CA) allows organizations to create a private CA hierarchy and issue certificates for internal use. This is essential for securing communication between internal services, devices, and users where a public trust chain is not required or is explicitly prohibited by security policies.

Practice this question →
6
MCQhard

A security engineer needs to identify and protect Personally Identifiable Information (PII) stored in thousands of S3 buckets across multiple AWS accounts. The solution must provide a centralized dashboard and use machine learning to classify data. Which service is best suited for this task?

A.Amazon Macie
B.Amazon GuardDuty
C.AWS Glue DataBrew
D.AWS Security Hub
AnswerA

Amazon Macie is specifically designed for S3 data discovery and classification. It uses machine learning to identify sensitive data like credit card numbers or names. Macie integrates with AWS Organizations, allowing a security hub account to manage discovery jobs across thousands of buckets and accounts from a single centralized dashboard.

Why this answer

Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically provides an inventory of S3 buckets and can be configured to scan objects for PII, providing a centralized view of data risks.

Practice this question →
7
MCQmedium

An organization is using AWS Secrets Manager to store database credentials. The security policy requires that these credentials be rotated every 30 days. The database is hosted on Amazon RDS. What is the most secure and automated way to implement this requirement?

A.Enable rotation in Secrets Manager and use a provided Lambda template to update the RDS credentials.
B.Use an Amazon EventBridge rule to trigger a manual password reset on the RDS instance every 30 days.
C.Store the credentials in an S3 bucket with versioning and use a Lifecycle policy to rotate the files.
D.Configure the RDS instance to automatically pull new credentials from Secrets Manager using IAM roles.
AnswerA

Using the built-in Secrets Manager rotation feature with a Lambda function is the AWS-recommended approach. The Lambda function handles the multi-step rotation process, which includes creating a new secret version, updating the database password, and testing the new credentials before finalizing the rotation to prevent application downtime.

Why this answer

AWS Secrets Manager integrates directly with Lambda to automate the rotation of secrets. For supported services like Amazon RDS, AWS provides pre-written Lambda templates that handle the complex logic of updating the password in the database and the secret value in Secrets Manager simultaneously, ensuring no service interruption occurs during the process.

Practice this question →
8
MCQhard

Refer to the exhibit. A developer is attempting to upload an object to 'my-secure-bucket' using the AWS CLI but receives an 'Access Denied' error. The developer's command was: 'aws s3 cp file.txt s3://my-secure-bucket/file.txt'. What is the most likely cause of the failure?

A.The developer does not have the kms:GenerateDataKey permission for the default KMS key used by the bucket.
B.The developer failed to include the '--sse aws:kms' parameter in the CLI command, violating the bucket policy condition.
C.The bucket policy is missing a 'Sid' (Statement ID) which makes the policy invalid and causes S3 to default to a 'Deny' for all requests.
D.The 'Resource' ARN in the policy is incorrectly formatted because it uses a wildcard, which is not allowed for s3:PutObject actions.
AnswerB

The bucket policy requires the encryption header to be set to 'aws:kms'. By default, the S3 CLI 'cp' command does not add this header. The developer must explicitly specify the server-side encryption method to satisfy the condition in the bucket policy and avoid the Deny effect.

Why this answer

The bucket policy explicitly denies any s3:PutObject request that does not include the SSE-KMS encryption header. The CLI command used by the developer did not specify an encryption method, causing the request to lack the required 's3:x-amz-server-side-encryption' header, which triggered the 'Deny' effect in the bucket policy.

Practice this question →
9
MCQmedium

A company is setting up a private Public Key Infrastructure (PKI) on AWS to issue certificates for internal microservices. They need to ensure that the private keys of the CA are protected by a FIPS 140-2 Level 3 validated Hardware Security Module (HSM). Which service should they use?

A.AWS Certificate Manager (ACM) with a public certificate request.
B.AWS Private CA.
C.AWS CloudHSM with a custom-built OpenSSL CA on EC2.
D.AWS Key Management Service (KMS) with an asymmetric key pair.
AnswerB

AWS Private CA is designed specifically for creating private CA hierarchies. It uses managed HSMs that are FIPS 140-2 Level 3 validated to protect the CA's private keys. This service allows you to issue and revoke certificates for internal resources securely while offloading the HSM management to AWS.

Why this answer

AWS Private CA (formerly ACM Private CA) uses FIPS 140-2 Level 3 validated HSMs to protect the private keys of the CA. This level of security is necessary for organizations that must meet high compliance standards for their internal certificate issuance and management, providing a secure, managed PKI solution.

Practice this question →
10
MCQeasy

A company wants to ensure that all new Amazon EBS volumes created in their account are automatically encrypted, regardless of whether the developer specifies encryption during the volume creation process. Which AWS feature should be used?

A.Enable 'EBS encryption by default' in the EC2 dashboard for each specific AWS region.
B.Create an IAM policy that denies the 'ec2:CreateVolume' action if the 'Encrypted' parameter is false.
C.Use an AWS Config rule to automatically delete any EBS volume that is found to be unencrypted.
D.Configure an S3 Bucket Policy to only allow encrypted EBS snapshots to be uploaded.
AnswerA

EBS encryption by default is a regional setting that, once enabled, automatically encrypts all new volumes and snapshots using a specified KMS key. This is the most effective way to enforce encryption at rest for block storage without requiring developers to change their existing workflows or deployment scripts.

Why this answer

EBS encryption by default is a region-specific setting that ensures every new EBS volume and snapshot copy created in the account is encrypted. This provides a safety net for security compliance, ensuring that no unencrypted data is inadvertently stored on block storage due to human error or misconfigured automation scripts.

Practice this question →
11
MCQmedium

Which service should be used to protect sensitive data from being exfiltrated via API calls to unauthorized services?

A.AWS WAF
B.VPC Endpoint Policies
C.AWS CloudTrail
D.AWS Shield
AnswerB

VPC Endpoint Policies are attached to VPC endpoints and allow you to define which AWS service actions are permitted. This is a highly effective way to prevent unauthorized data exfiltration by ensuring that only approved AWS services can be accessed from within your VPC.

Why this answer

VPC endpoints, specifically Interface Endpoints (powered by AWS PrivateLink), allow you to restrict traffic to specific AWS services. By using a VPC Endpoint Policy, you can restrict API calls to only those services you explicitly authorize. This provides a robust preventative control that stops data from being sent to unauthorized accounts or services, even if an identity is compromised.

Practice this question →
12
Multi-Selecthard

A company stores sensitive PII in RDS MySQL databases. The security team wants to ensure that data is encrypted at rest and that the encryption keys are rotated annually. Which TWO actions fulfill these requirements?

Select 2 answers
A.Enable RDS encryption using an AWS managed key and configure annual rotation.
B.Enable RDS encryption using a customer-managed key during instance creation.
C.Configure the customer-managed KMS key to perform automatic annual key rotation.
D.Modify the existing RDS instance to enable encryption after the initial launch.
E.Enable Transparent Data Encryption (TDE) via the RDS option group.
AnswersB, C

Enabling encryption during the RDS instance launch is the only way to ensure the underlying storage volume is encrypted. By selecting a customer-managed key, you gain the authority to manage the key's lifecycle, including setting the necessary rotation policies to meet your specific security requirements.

Why this answer

Enabling RDS encryption at the time of instance creation is mandatory for at-rest protection, as this cannot be added to an existing unencrypted instance. Additionally, using AWS KMS customer-managed keys allows the administrator to control the rotation schedule manually or via automatic rotation features, ensuring the underlying cryptographic material is refreshed regularly to maintain compliance and reduce the potential impact of a compromised key.

Practice this question →
13
Multi-Selectmedium

A company is migrating a legacy database to Amazon RDS for MySQL and must ensure the data is protected according to strict compliance standards. The security team requires that the data at rest is encrypted and that the encryption cannot be disabled after the instance is created. Which TWO statements accurately describe RDS encryption behavior?

Select 2 answers
A.Encryption at rest can be enabled for an existing unencrypted RDS DB instance by modifying the instance settings.
B.Snapshots and automated backups of an encrypted RDS instance are automatically encrypted using the same KMS key.
C.Read replicas of an encrypted RDS instance must also be encrypted using the same KMS key as the primary instance.
D.Encryption at rest can be disabled on an RDS instance to improve performance during large data imports.
E.RDS encryption at rest only protects the database tables and does not apply to logs or temporary files.
AnswersB, C

When you encrypt an RDS DB instance, all its subsequent snapshots and automated backups are automatically encrypted using the same KMS key as the parent instance. This ensures consistent data protection throughout the entire lifecycle of the data, including recovery points and archival storage in Amazon S3.

Why this answer

Amazon RDS encryption at rest is a foundational security feature that must be decided at the time of resource creation. It uses the AES-256 encryption algorithm to protect data stored on the underlying volumes, as well as backups and snapshots. Understanding the lifecycle of encrypted instances is critical for maintaining a secure data environment.

Practice this question →
14
MCQmedium

A company needs to share an encrypted EBS volume snapshot with a partner's AWS account. The snapshot is encrypted with a customer-managed KMS key. What must the company do to enable this sharing?

A.Copy the snapshot to an unencrypted state, then share the unencrypted snapshot.
B.Share the snapshot and update the KMS key policy to permit usage by the partner.
C.Export the snapshot to an S3 bucket and provide the partner with the S3 URL.
D.Use AWS DataSync to copy the volume data directly to the partner account.
AnswerB

Sharing the snapshot makes it visible to the partner, but they cannot decrypt it without access to the key. Updating the KMS key policy allows the partner's IAM entities to use the key for cryptographic operations, which is required to successfully restore or use the shared encrypted snapshot.

Why this answer

Sharing encrypted snapshots requires sharing both the snapshot and the associated KMS key. Because the partner account cannot use the owner's KMS key directly, the key policy must be modified to allow the partner account to use the key for decryption. This ensures the partner can access the encrypted data while maintaining the security of the encryption process through AWS KMS.

Practice this question →
15
MCQhard

An application in Account A needs to decrypt S3 objects in Account B using a KMS key in Account B. What is the minimal configuration required?

A.Only update the IAM policy in Account A to allow 'kms:Decrypt'.
B.Only update the KMS key policy in Account B to allow the role from Account A.
C.Update the IAM policy in Account A and the KMS key policy in Account B.
D.Create an IAM user in Account B and provide credentials to the application.
AnswerC

This dual-policy configuration is required for cross-account access. The key policy grants permission to the external account's role, and the IAM policy ensures the role has permission to exercise that grant. This combination follows the principle of least privilege while enabling necessary cross-account functionality.

Why this answer

To enable cross-account access, the KMS key policy in Account B must explicitly permit the IAM role in Account A to perform 'kms:Decrypt'. Furthermore, the IAM role in Account A must also have an IAM policy granting it the permission to perform 'kms:Decrypt' on the specific KMS key ARN in Account B. Both policies must be present; if either is missing, the operation will fail.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Data Protection questions.

Start 20-question session