Data Protection practice questions

Enable automatic key rotation on the existing CMK.

Why wrong: Enabling automatic rotation on the existing CMK does not satisfy the 90-day rotation requirement because AWS KMS automatic rotation is traditionally based on a 365-day schedule in the context of this exam; it cannot be set to a 90-day cadence. Additionally, automatic rotation keeps the same key ID and only generates new backing key material, so it does not provide a new key identity as required by many compliance frameworks. Therefore, this option fails to meet the mandatory rotation period and is incorrect.

Use a CMK with imported key material and rotate the material every 90 days.

Why wrong: Manually importing new key material every 90 days fails to automate the rotation process and requires manual intervention, which does not resolve the downtime caused by updating application configurations. This approach is intended for scenarios where you must maintain control over key generation outside of AWS or comply with specific regulatory requirements necessitating external entropy. It becomes the correct choice when a company must use keys generated within an on-premises Hardware Security Module (HSM).

Continue creating new CMKs but use a script to update the application configuration files.

Why wrong: While creating new CMKs each 90 days is directionally correct, using a script to update application configuration files with the new key ID introduces manual-like intervention and downtime risks. Applications must be redeployed or restarted to load the new key ID, and script failures can cause encryption operations to target a key the application cannot access or that is no longer the intended one. This approach also duplicates alias indirection per application instead of centralizing the pointer, making it operationally fragile and not a best practice.

Enable S3 Object Lock in Governance mode with a retention period of 30 days.

Why wrong: S3 Object Lock's governance mode enforces a WORM (write-once-read-many) model that blocks all deletions—including overwrites—of object versions during the 30-day retention period. Even though users with the s3:BypassGovernanceRetention permission can delete, normal users cannot, which directly conflicts with the requirement to allow deletion. Moreover, if an object is deleted after bypassing governance, there is no versioning-based recovery mechanism, so this option does not provide the needed recoverability.

Remove the s3:DeleteObject permission from all IAM policies and use S3 Lifecycle policies to expire objects after 30 days.

Why wrong: Removing s3:DeleteObject from all IAM policies simply denies users the ability to delete objects, but this does not match the stated requirement to 'allow deletion' in a recoverable manner. S3 Lifecycle policies set to expire objects after 30 days cause the S3 service to permanently delete objects—and with no versioning, this is unrecoverable. It also introduces an automatic deletion path that could destroy data before an administrator has a chance to review it, so this combination is neither user-driven nor recoverable.

Change the default encryption from SSE-S3 to SSE-C and use a separate key for each object.

Why wrong: Encryption choice is orthogonal to deletion semantics: SSE-C (customer-provided keys) only encrypts the data at rest and does not affect the object lifecycle, versioning, or deletion behavior. Using a separate SSE-C key per object adds cryptographic separation but provides no logical deletion recovery—once an object is deleted, neither the object nor its encrypted ciphertext is restored by any key. Since this option doesn't introduce versioning or an undelete mechanism, it fails to address the core requirement of recovering deleted objects.

Use an AWS managed key and enable automatic rotation.

Why wrong: AWS managed keys already have automatic rotation enabled by the service, so enabling it is not an action you can take; more importantly, their fixed rotation schedule is not aligned with a yearly requirement, as AWS rotates these keys on a longer fixed cycle rather than annually. This option fails because you have no configuration control over the rotation period of an AWS managed key, and the stated yearly requirement would not be met.

Use a customer managed key with imported key material and enable automatic rotation.

Why wrong: Although a customer managed key is the right key family, imported key material disqualifies it from automatic rotation; KMS does not support automatic rotation for symmetric customer managed keys whose key material was imported. To use automatic rotation with a 365-day period, the key material must be generated and maintained by AWS KMS. This option therefore cannot meet the company's yearly rotation goal.

Use an AWS managed key and manually rotate it every year.

Why wrong: Manual rotation of an AWS managed key is not a supported operation because AWS owns and manages the entire lifecycle of these keys. You cannot create a new key version, replace key material, or trigger rotation on demand for an AWS managed key; only customer managed keys support manual rotation through alias updates or new key creation. Therefore, attempting to manually rotate an AWS managed key each year is invalid and cannot satisfy the compliance requirement.

Create VPC, then create subnets, then create NAT Gateway, then create and attach Internet Gateway, then update route tables.

Why wrong: This is incorrect because the NAT Gateway requires a public subnet with a route to an Internet Gateway to function. If the Internet Gateway is created after the NAT Gateway, the NAT Gateway cannot be properly associated with a public subnet, leading to failure.

Create VPC, then create subnets, then create and attach Internet Gateway, then update route tables, then create NAT Gateway.

Why wrong: This is incorrect because updating route tables before creating the NAT Gateway results in a missing target for the private subnet route. The route tables need the NAT Gateway ID to be specified, which is not available until the NAT Gateway is created.

Create VPC, then create NAT Gateway, then create subnets, then create and attach Internet Gateway, then update route tables.

Why wrong: This order is invalid because a NAT Gateway cannot be provisioned without an existing subnet ID — AWS returns an error if the subnet does not exist, since the gateway is deployed as an elastic network interface inside that subnet. Even if creation were possible, the NAT Gateway must be placed in a public subnet that already has an attached Internet Gateway and a default (0.0.0.0/0) route to it, which is not present at this stage. The NAT Gateway would therefore be orphaned with no outbound path, and the later route table update for private subnets would reference a NAT device that cannot function.

Configure an S3 lifecycle policy to re-encrypt objects

Why wrong: Incorrect. An S3 lifecycle policy does not re-encrypt objects; it transitions objects to different storage classes or expires them.

Manually rotate the key every 90 days and re-encrypt all objects

Why wrong: Incorrect. Manually rotating the key and re-encrypting all objects is not a combination; it is a single action, and the question asks for two actions. Additionally, manual rotation is not automatic.

Delete the existing key and create a new one each 90 days

Why wrong: Incorrect. Deleting the existing key breaks access to existing objects, as they cannot be decrypted.

Enable automatic key rotation in AWS KMS for the customer managed key

Why wrong: Incorrect. AWS KMS automatic key rotation for customer managed keys is annual (365 days), not every 90 days, so it does not satisfy the requirement.

Use an S3 bucket policy that denies decrypt for all principals except the specific IAM user.

Why wrong: Incorrect. S3 bucket policies cannot deny or allow KMS actions. KMS decrypt permissions are controlled by KMS key policies and IAM policies. Additionally, the option mentions an IAM user, not a role.

Configure the IAM role with a policy that allows kms:Decrypt for the specific KMS key.

Why wrong: Incorrect. While the IAM role can be granted kms:Decrypt via an IAM policy, the KMS key policy must also allow the role. Moreover, this approach does not restrict the decrypt to S3 only; additional conditions like kms:ViaService are needed.

Attach a resource-based policy to the S3 bucket that grants decrypt permission to the IAM role.

Why wrong: Incorrect. S3 bucket policies are resource-based policies for S3 actions, not for KMS actions. They cannot grant KMS decrypt permissions. Only KMS key policies (or IAM policies with key policy allow) can grant KMS decrypt.

Configure the ALB with a TCP listener and use Network Load Balancer.

Why wrong: TCP does not provide encryption.

Configure the ALB security group to allow only encrypted traffic.

Why wrong: Security groups do not enforce encryption.

Configure the ALB with an HTTP listener and use a security group to enforce encryption.

Why wrong: HTTP does not encrypt data.

Use a custom key store and rotate keys manually.

Why wrong: Custom key stores do not support automatic key rotation; any rotation would be manual, so this does not meet the automatic yearly rotation requirement.

Use a CloudHSM to store keys and rotate them manually.

Why wrong: CloudHSM does not provide automatic key rotation; manual rotation is required, so this is incorrect.

Use an AWS managed key, which rotates automatically every year.

Why wrong: AWS managed keys rotate automatically every three years, not every year, so this does not meet the requirement.

Store IAM user access keys in the instance's user data.

Why wrong: Storing access keys on the instance is insecure.

Attach a KMS key policy that allows the instance to decrypt S3 objects.

Why wrong: EC2 does not support KMS key-based direct access to S3.

Generate S3 pre-signed URLs for all objects the instance needs to access.

Why wrong: S3 pre-signed URLs are for granting temporary access to specific objects, not for general instance access.

Copy the AMI and share the copy; the key is automatically shared

Why wrong: Copying an encrypted AMI requires key access in the source account.

Only modify the AMI launch permissions to include the target account

Why wrong: Only sharing the AMI is insufficient; the KMS key must also be shared.

Only add the target account to the KMS key policy

Why wrong: Only sharing the KMS key is insufficient; the AMI launch permissions must also be modified.

Enable cross-region replication

Why wrong: Replicates but does not prevent deletion.

Apply a bucket policy that denies s3:DeleteObject

Why wrong: Denying s3:DeleteObject does not prevent object overwrites (which are s3:PutObject operations). Additionally, MFA Delete and versioning together provide stronger protection against both deletion and overwrite.

Enable default encryption on the bucket

Why wrong: Does not prevent deletion.

A statement that defines the key alias

Why wrong: Alias is separate from key policy.

A statement that enables automatic key rotation

Why wrong: Rotation is configured separately, not in key policy.

Use SSE-C and upload new keys to S3 every 90 days.

Why wrong: Incorrect because SSE-C requires you to manage and upload new keys manually every 90 days; there is no automatic rotation.

Use SSE-S3 and enable automatic key rotation in the S3 bucket properties.

Why wrong: Incorrect because SSE-S3 uses Amazon S3-managed keys, not customer-provided keys, and key rotation is managed by AWS.

Use AWS CloudHSM and generate a new key every 90 days via a custom script.

Why wrong: Incorrect because CloudHSM does not provide automatic key rotation; it would require a custom script to generate and rotate keys, which is not automatic.

Use Amazon EBS encryption on the EC2 instance's root volume.

Why wrong: EBS encryption does not offload application-level encryption operations.

Use the Linux dm-crypt utility to encrypt the data at the application level.

Why wrong: Application-level encryption adds CPU overhead.

Use AWS KMS with a customer-managed key to encrypt the data in the application.

Why wrong: KMS is software-based; does not provide a dedicated HSM.

Use SSE-S3.

Why wrong: SSE-S3 is an S3-specific encryption mode that uses S3-managed keys to encrypt objects at rest in Amazon Simple Storage Service. EBS volumes are block-level storage devices attached to EC2 instances, not S3 objects, so SSE-S3 has no ability to encrypt the volume's raw blocks. Applying SSE-S3 would not meet the EBS encryption requirement.

Use a customer-managed KMS key with automatic rotation enabled.

Why wrong: A customer-managed KMS key is created and owned by the company, giving full control over rotation schedule, key policy, and deletion. You can enable automatic rotation for such a key, but in this scenario the requirement specifically asks for an AWS managed key for EBS, not a customer-owned key. Choosing a customer-managed key would introduce additional key management duties and would not match the stated need, making it incorrect here.

Use client-side encryption.

Why wrong: Client-side encryption requires the application to encrypt data before writing it to the EBS volume, meaning the volume itself remains unencrypted at rest. This approach depends on the application implementing and managing encryption logic, and it does not provide the transparent, OS-level encryption offered by native EBS encryption. Because the requirement is for the EBS volume to be encrypted at rest, client-side encryption is not a direct solution.

Enable versioning on the bucket.

Why wrong: Versioning preserves object versions but does not enforce encryption.

Enable MFA Delete on the bucket.

Why wrong: MFA Delete is for deletion protection, not encryption enforcement.

Use a site-to-site VPN connection to the VPC and then access S3 via a VPC endpoint.

Why wrong: VPN encrypts but still traverses the internet or VPN connection, exposing it to some risks compared to PrivateLink.

Use AWS Direct Connect without additional encryption.

Why wrong: Direct Connect provides a private connection but without encryption; additional encryption is needed, so it is not the highest security.

Access S3 over HTTPS from the on-premises application.

Why wrong: HTTPS over internet uses encryption but is exposed to internet threats, making it less secure than PrivateLink.

Use SSE-KMS with AWS managed key

Why wrong: With SSE-KMS using an AWS managed KMS key, S3 calls KMS on your behalf, but AWS owns the key and fixes its automatic rotation to approximately once per year; you cannot set a 90-day schedule or perform on-demand rotation on an aws/s3 managed key. Envelope encryption is present, but the rotation requirement fails because the key lifecycle is entirely outside your control.

Use SSE-S3 and enable automatic key rotation

Why wrong: SSE-S3 uses Amazon-managed root keys with AES-256, and although every object gets a unique data key, S3 controls when the root key is rotated, roughly every 12 months; there is no S3 setting or API to change that cadence to 90 days. The key hierarchy is invisible and not customer-accessible, so you cannot prove compliance with a 90-day rotation policy or force a rotation event when needed.

Use SSE-C and rotate the customer-provided key every 90 days

Why wrong: SSE-C places encryption key management entirely in your hands: you must generate, store, and provide the raw AES-256 key on every PUT and GET, and S3 does not persist that key. Rotating it every 90 days forces you to maintain every previous key version to decrypt existing objects and creates high operational overhead, plus the risk of permanent data loss if key material is lost, because no AWS-managed envelope or key hierarchy exists to simplify rotation.

Enable encryption on the existing EBS volume

Why wrong: Enabling encryption directly on an existing EBS volume is not possible; EBS encryption is a setting configured only at the time of volume creation. To encrypt an unencrypted volume that already exists, a snapshot must first be taken, and then a *new*, encrypted volume created from that snapshot. This option is tempting because one *can* enable encryption, but only when provisioning a *new* EBS volume, making it the correct choice for ensuring data is encrypted from inception for newly created volumes.

Use an instance store volume that supports encryption

Why wrong: Wrong: Instance store volumes are not persistent and not encrypted by EBS.

Encrypt the data at the application layer before writing to the volume

Why wrong: Wrong: This is not an EBS encryption feature.

Create a new bucket with a bucket policy that requires SSE-KMS, and migrate all objects using S3 Batch Operations

Why wrong: Incorrect. Creating a new bucket and migrating objects using S3 Batch Operations is unnecessary. The existing bucket can be updated with the correct bucket policy to enforce SSE-KMS for future uploads, and existing objects remain accessible.

Modify the bucket's default encryption configuration to use SSE-KMS

Why wrong: Incorrect. Modifying the bucket's default encryption to SSE-KMS only sets a default encryption method for objects that do not specify any encryption. It does not enforce that all uploads use SSE-KMS, as a user can still upload with a different encryption setting.

Enable S3 Object Lock on the bucket to prevent overwrites, and use a lifecycle policy to expire objects that are not encrypted with SSE-KMS

Why wrong: Incorrect. S3 Object Lock and lifecycle policies do not enforce encryption at the time of upload. They can manage object locks and expiration, but cannot require that objects are encrypted with a specific method.