SCS-C02 Data Protection Practice Question
A company uses Amazon SQS to decouple its microservices. The messages contain personally identifiable information (PII). The security team requires that all messages be encrypted at rest. Currently, SQS is configured with SSE enabled using a customer managed KMS key. However, the team discovers that some messages are still being stored in plaintext in the dead-letter queue (DLQ) after the maximum receives are exceeded. The DLQ is also an SQS queue. What is the MOST likely reason?
⚠ Common exam trap
The trap is assuming encryption settings propagate from a source queue to its DLQ; in SQS, SSE is per-queue, so the DLQ must be encrypted separately.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DLQ does not have SSE enabled, so messages are stored in plaintext.
SSE is configured per queue, not inherited. Enabling SSE with a customer-managed KMS key on the source queue does not automatically encrypt the DLQ; if the DLQ was created without SSE, messages moved there are stored using SQS's default (no encryption at rest) behavior, exposing the PII in plaintext. Each SQS queue, including a DLQ, must have its own encryption configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The source queue's SSE is configured with AWS managed KMS key, which does not support cross-account DLQ.
Why it's wrong here
Incorrect. The scenario explicitly states that the source queue uses a customer managed KMS key, not an AWS managed key. Even if it used an AWS managed key, that would only matter for cross-account redrive when the DLQ is in a different AWS account; here both queues reside in the same account, so the key type is irrelevant. The actual problem remains that the DLQ does not have SSE enabled.
- ✓
The DLQ does not have SSE enabled, so messages are stored in plaintext.
Why this is correct
This is correct. SSE is a per-queue setting, so enabling it on the source queue does not automatically protect the DLQ. When a message is redriven, SQS decrypts it from the source queue and writes it to the DLQ using whatever encryption the DLQ has configured. If the DLQ has no SSE, the message is stored as plaintext, directly violating the company's requirement that messages be encrypted at rest.
- ✗
The source queue's SSE configuration uses a different KMS key than the DLQ, causing decryption failure.
Why it's wrong here
Incorrect. During a redrive, SQS decrypts the message from the source queue using that queue's own KMS key, and then encrypts it for the DLQ using the DLQ's KMS key. The two queues are not required to share a KMS key; each queue has its own independent SSE configuration. A mismatch would only cause an error if the DLQ's key policy were to deny SQS the necessary Encrypt permission, not because the keys differ.
- ✗
The KMS key policy does not allow the SQS service to decrypt the messages before moving them to the DLQ.
Why it's wrong here
Incorrect. The decryption required to read a message from the source queue is handled by the source queue's KMS key, and the key policy for that key must indeed grant SQS permission to decrypt. However, the actual fault in this scenario is that the DLQ has no SSE at all, so SQS does not attempt to re-encrypt after redrive. A missing Decrypt permission on the source key would instead cause the redrive to fail, leaving messages in the source queue rather than silently storing them in plaintext.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.