SCS-C02 Data Protection Practice Question
A healthcare company stores sensitive patient data in Amazon S3. The security team has implemented a data protection strategy that includes S3 default encryption using SSE-KMS with a customer managed key. They also use S3 Object Lock to prevent deletion. Recently, an administrator accidentally deleted the KMS key used for encryption. As a result, all objects in the bucket are now inaccessible. The company has a backup of the key material but does not have the original key ID. Which action should the team take to restore access to the data?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Import the key material into a new KMS key and re-encrypt all objects using S3 Batch Operations.
When a KMS key is deleted and you have a backup of the key material, you can import that material into a new KMS key. Even though the new key has a different key ID, because the cryptographic material is identical, it can decrypt the data keys that were encrypted with the original key. S3 Batch Operations can then re-encrypt all objects under the new key, restoring access. Option A is incorrect because the objects were encrypted with SSE-KMS, meaning the data key itself is encrypted by KMS and cannot be decrypted without the KMS key. Option C is incorrect because KMS does not allow you to specify the key ID when creating a new key; AWS generates a unique key ID. Option D is incorrect because CloudHSM is a separate service for generating and storing keys; it is not used to back up KMS keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the backup key material directly in an application to decrypt objects without KMS.
Why it's wrong here
Objects encrypted with KMS require KMS to decrypt; you cannot bypass KMS.
- ✓
Import the key material into a new KMS key and re-encrypt all objects using S3 Batch Operations.
Why this is correct
You can create a new key and re-encrypt objects, but you need the original key material to decrypt first.
- ✗
Create a new KMS key with the same key ID using the backup material.
Why it's wrong here
KMS does not allow specifying a key ID during creation.
- ✗
Restore the deleted KMS key from the CloudHSM backup.
Why it's wrong here
Once deleted, a KMS key cannot be restored; you must have disabled it.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.