Data Protection practice questions

A company stores sensitive data in Amazon S3 and wants to ensure that all objects are encrypted at rest. The security team has enabled default encryption on the S3 bucket using SSE-S3. However, an audit reveals that some objects are stored with SSE-KMS. How can the company enforce that only SSE-S3 is used for all future uploads, while still allowing existing SSE-KMS objects to be read?

Trap 1: Configure a bucket policy that denies s3:PutObject with…

This would also deny reading objects encrypted with SSE-KMS if the policy is applied to all actions.

Trap 2: Use an S3 Lifecycle policy to transition existing SSE-KMS objects…

Lifecycle policies do not change encryption of existing objects; they only transition storage class.

Trap 3: Disable SSE-KMS in the AWS KMS key policy to prevent its use.

Disabling the key would make existing SSE-KMS objects unreadable.

A
Configure a bucket policy that denies s3:PutObject with s3:x-amz-server-side-encryption-aws:kms.
Why wrong: This would also deny reading objects encrypted with SSE-KMS if the policy is applied to all actions.
B
Use an S3 Lifecycle policy to transition existing SSE-KMS objects to SSE-S3.
Why wrong: Lifecycle policies do not change encryption of existing objects; they only transition storage class.
C
Apply a bucket policy that denies s3:PutObject unless the x-amz-server-side-encryption header is AES256.
This policy enforces SSE-S3 for uploads without affecting reads of existing objects.
D
Disable SSE-KMS in the AWS KMS key policy to prevent its use.
Why wrong: Disabling the key would make existing SSE-KMS objects unreadable.

Question 2hardmultiple choice

A financial services company uses AWS KMS to encrypt sensitive data. The security team has a requirement to rotate the CMK every 90 days and to maintain a record of all previous key versions for decryption of historical data. The team creates a new CMK every 90 days and manually updates applications to use the new key. This process is error-prone and causes downtime. What is the MOST operationally efficient solution that meets the requirements?

Trap 1: Enable automatic key rotation on the existing CMK.

Automatic rotation is only available annually (365 days), not 90 days.

Trap 2: Use a CMK with imported key material and rotate the material every…

Importing key material is more complex and still requires manual rotation.

Trap 3: Continue creating new CMKs but use a script to update the…

This still requires manual intervention and downtime.

A
Enable automatic key rotation on the existing CMK.
Why wrong: Automatic rotation is only available annually (365 days), not 90 days.
B
Create a new CMK every 90 days and update the alias to point to the new key. Applications reference the alias.
Alias updates are immediate and do not require application changes; old keys remain available for decryption.
C
Use a CMK with imported key material and rotate the material every 90 days.
Why wrong: Importing key material is more complex and still requires manual rotation.
D
Continue creating new CMKs but use a script to update the application configuration files.
Why wrong: This still requires manual intervention and downtime.

Question 3easymultiple choice

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

Trap 1: Use AWS KMS with a customer master key (CMK) and import key…

KMS does not allow direct use of an external HSM for key management; imported key material is still inside KMS.

Trap 2: Store the encryption keys in AWS Secrets Manager and use them to…

Secrets Manager is not designed for database encryption at rest; it's for application secrets.

Trap 3: Use AWS KMS with a custom key store backed by AWS CloudHSM.

This uses CloudHSM but the key management is still through KMS, and you don't directly control the HSM.

A
Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.
CloudHSM provides a dedicated HSM that you control, and RDS can be encrypted using keys from CloudHSM.
B
Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.
Why wrong: KMS does not allow direct use of an external HSM for key management; imported key material is still inside KMS.
C
Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.
Why wrong: Secrets Manager is not designed for database encryption at rest; it's for application secrets.
D
Use AWS KMS with a custom key store backed by AWS CloudHSM.
Why wrong: This uses CloudHSM but the key management is still through KMS, and you don't directly control the HSM.

Question 4mediummulti select

A company is designing a data protection strategy for its Amazon S3 bucket that stores sensitive documents. The security team requires that all data be encrypted in transit and at rest, and that any accidental deletion of objects can be reversed within 30 days. Additionally, the company must be able to audit all access attempts to the bucket, including failed attempts. Which TWO actions should the company take to meet these requirements? (Choose two.)

Trap 1: Enable default encryption on the bucket using SSE-S3.

SSE-S3 only encrypts at rest, not in transit.

Trap 2: Enable S3 server access logs and send them to a separate bucket.

Access logs do not capture failed attempts reliably; CloudTrail is preferred for auditing.

Trap 3: Enable MFA Delete on the bucket.

MFA Delete provides extra protection but does not allow reversal of deletion; versioning does.

A
Enable default encryption on the bucket using SSE-S3.
Why wrong: SSE-S3 only encrypts at rest, not in transit.
B
Enable AWS CloudTrail with data events for S3.
CloudTrail logs all API calls, including failed ones, for auditing.
C
Enable S3 Versioning on the bucket.
Versioning allows recovery of deleted objects within the version retention period.
D
Enable S3 server access logs and send them to a separate bucket.
Why wrong: Access logs do not capture failed attempts reliably; CloudTrail is preferred for auditing.
E
Enable MFA Delete on the bucket.
Why wrong: MFA Delete provides extra protection but does not allow reversal of deletion; versioning does.

Question 5hardmultiple choice

A healthcare company runs a HIPAA-compliant application on AWS. The application uses Amazon S3 to store Protected Health Information (PHI). The company has implemented the following controls: (1) All S3 buckets are configured with default encryption using SSE-S3. (2) Bucket policies restrict access to only authorized IAM roles. (3) S3 access logs are enabled and sent to a centralized logging account. (4) MFA Delete is enabled on all buckets. (5) Object lock is not enabled. Recently, an internal auditor discovered that when an authorized user deletes an object, the object is permanently deleted and cannot be recovered. The company's data retention policy requires that deleted PHI be recoverable for at least 30 days after deletion. A review of the IAM policies shows that users have s3:DeleteObject permission. The auditor also notes that the bucket versioning is not enabled. The security team needs to implement a solution that allows authorized users to delete objects but ensures that deleted objects can be recovered within 30 days. Which of the following is the MOST effective course of action?

Trap 1: Enable S3 Object Lock in Governance mode with a retention period of…

Object Lock prevents deletion entirely during the retention period, which may conflict with the need to allow deletion.

Trap 2: Remove the s3:DeleteObject permission from all IAM policies and use…

This prevents users from deleting objects, which is not the requirement; also lifecycle expiration is permanent deletion.

Trap 3: Change the default encryption from SSE-S3 to SSE-C and use a…

Encryption method does not affect deletion recovery.

A
Enable S3 Object Lock in Governance mode with a retention period of 30 days.
Why wrong: Object Lock prevents deletion entirely during the retention period, which may conflict with the need to allow deletion.
B
Enable S3 Versioning on the buckets and ensure that the IAM policies include s3:DeleteObjectVersion where appropriate.
Versioning allows recovery of deleted objects via delete markers or version restoration.
C
Remove the s3:DeleteObject permission from all IAM policies and use S3 Lifecycle policies to expire objects after 30 days.
Why wrong: This prevents users from deleting objects, which is not the requirement; also lifecycle expiration is permanent deletion.
D
Change the default encryption from SSE-S3 to SSE-C and use a separate key for each object.
Why wrong: Encryption method does not affect deletion recovery.

Question 6mediummultiple choice

A company uses AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which solution meets this requirement?

Trap 1: Use an AWS managed key and enable automatic rotation.

AWS managed keys automatically rotate every three years, not yearly.

Trap 2: Use a customer managed key with imported key material and enable…

Imported key material cannot be rotated automatically.

Trap 3: Use an AWS managed key and manually rotate it every year.

AWS managed keys cannot be manually rotated.

A
Use an AWS managed key and enable automatic rotation.
Why wrong: AWS managed keys automatically rotate every three years, not yearly.
B
Use a customer managed key with imported key material and enable automatic rotation.
Why wrong: Imported key material cannot be rotated automatically.
C
Use a customer managed key and enable automatic rotation with a yearly rotation period.
Customer managed keys support automatic rotation with a configurable period (yearly).
D
Use an AWS managed key and manually rotate it every year.
Why wrong: AWS managed keys cannot be manually rotated.

Question 7hardmulti select

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Trap 1: Enable encryption at rest on the EC2 instances.

Encryption at rest does not affect encryption in transit.

Trap 2: Use a network load balancer instead of an ALB.

NLB supports TLS termination but the question specifies ALB.

Trap 3: Assign a certificate from ACM to the ALB listener.

While necessary, this alone doesn't enforce encryption in transit. The target group protocol is also needed.

A
Configure the target group to use HTTPS protocol.
HTTPS target group ensures encryption between ALB and EC2.
B
Enable encryption at rest on the EC2 instances.
Why wrong: Encryption at rest does not affect encryption in transit.
C
Use a network load balancer instead of an ALB.
Why wrong: NLB supports TLS termination but the question specifies ALB.
D
Assign a certificate from ACM to the ALB listener.
Why wrong: While necessary, this alone doesn't enforce encryption in transit. The target group protocol is also needed.
E
Configure the ALB listener to use HTTPS protocol.
HTTPS listener enables encryption between client and ALB.

Question 8easymultiple choice

Refer to the exhibit. An AWS KMS key policy includes the statement shown. The AdminRole tries to decrypt a ciphertext that was encrypted using the same KMS key with encryption context 'department=engineering'. What will happen?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AdminRole"
      },
      "Action": "kms:Decrypt",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:EncryptionContext:department": "finance"
        }
      }
    }
  ]
}

Trap 1: The decrypt operation succeeds because the role has kms:Decrypt…

The condition must be satisfied, otherwise access is denied.

Trap 2: The decrypt operation succeeds because the encryption context is…

Encryption context is used in authorization for KMS operations.

Trap 3: The decrypt operation fails because the policy does not allow…

Actually, the condition denies access when mismatched.

A
The decrypt operation succeeds because the role has kms:Decrypt permission.
Why wrong: The condition must be satisfied, otherwise access is denied.
B
The decrypt operation succeeds because the encryption context is ignored during decryption.
Why wrong: Encryption context is used in authorization for KMS operations.
C
The decrypt operation fails because the policy does not allow kms:Decrypt without matching context.
Why wrong: Actually, the condition denies access when mismatched.
D
The decrypt operation fails because the encryption context does not match the condition.
The condition 'department=finance' is not met, so access is denied.

Read the full NAT/PAT explanation →

Question 9mediumdrag order

Drag and drop the steps to configure a VPC with private subnets and NAT gateway for outbound internet access in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10mediummatching

Match each AWS security-related acronym to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Center for Internet Security

Payment Card Industry Data Security Standard

Health Insurance Portability and Accountability Act

System and Organization Controls

International standard for information security management

Question 11mediummultiple choice

A company uses S3 to store sensitive customer data. The security team requires that all objects uploaded to S3 be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). A developer reports that some objects are being stored unencrypted. What is the MOST effective way to enforce this requirement?

Trap 1: Enable default encryption on the bucket using SSE-S3

SSE-S3 does not use KMS keys.

Trap 2: Use an SCP to deny s3:PutObject without encryption

SCPs are not effective at resource level.

Trap 3: Set a bucket policy to require the x-amz-server-side-encryption…

Default encryption does not enforce encryption header.

A
Enable default encryption on the bucket using SSE-S3
Why wrong: SSE-S3 does not use KMS keys.
B
Use a bucket policy to deny s3:PutObject if encryption is not set to aws:kms
Policy condition can enforce SSE-KMS.
C
Use an SCP to deny s3:PutObject without encryption
Why wrong: SCPs are not effective at resource level.
D
Set a bucket policy to require the x-amz-server-side-encryption header
Why wrong: Default encryption does not enforce encryption header.

Question 12easymultiple choice

A company wants to protect data at rest for an Amazon RDS for PostgreSQL database. Which AWS service should be used to manage the encryption keys?

Trap 1: AWS CloudHSM

CloudHSM is for dedicated HSM, not default key management.

Trap 2: AWS Certificate Manager (ACM)

ACM handles certificates, not encryption keys.

Trap 3: AWS Secrets Manager

Secrets Manager stores secrets, not encryption keys for RDS.

A
AWS CloudHSM
Why wrong: CloudHSM is for dedicated HSM, not default key management.
B
AWS Key Management Service (KMS)
KMS manages keys for RDS encryption.
C
AWS Certificate Manager (ACM)
Why wrong: ACM handles certificates, not encryption keys.
D
AWS Secrets Manager
Why wrong: Secrets Manager stores secrets, not encryption keys for RDS.

Read the full NAT/PAT explanation →

Question 13hardmulti select

A company has a requirement to automatically rotate encryption keys for S3 objects every 90 days. They are using SSE-KMS with a customer managed key. Which combination of actions will meet the requirement without breaking access to existing objects? (Choose two.)

Trap 1: Configure an S3 lifecycle policy to re-encrypt objects

S3 lifecycle does not re-encrypt.

Trap 2: Manually rotate the key every 90 days and re-encrypt all objects

Manual rotation is not needed if automatic rotation is enabled.

Trap 3: Delete the existing key and create a new one each 90 days

Deleting the old key will break access to existing objects.

A
Configure an S3 lifecycle policy to re-encrypt objects
Why wrong: S3 lifecycle does not re-encrypt.
B
Use S3 Batch Operations to re-encrypt existing objects with the new key
Batch Operations can re-encrypt objects.
C
Manually rotate the key every 90 days and re-encrypt all objects
Why wrong: Manual rotation is not needed if automatic rotation is enabled.
D
Delete the existing key and create a new one each 90 days
Why wrong: Deleting the old key will break access to existing objects.
E
Enable automatic key rotation in AWS KMS for the customer managed key
Automatic rotation creates new backing keys annually.

Question 14mediummultiple choice

A company uses AWS KMS to encrypt EBS volumes. The security team wants to ensure that when an EC2 instance is launched, the attached EBS volumes are always encrypted using a specific customer managed key. Which action will enforce this?

Trap 1: Create an IAM role that requires the ec2:RunInstances action to…

IAM roles are not used to enforce encryption policies.

Trap 2: Configure the KMS key policy to allow only the specific key for EBS…

Key policy does not enforce which key is used at launch.

Trap 3: Enable encryption by default for EBS volumes in the account

Default encryption uses the default KMS key, not a specific one.

A
Use a service control policy (SCP) to deny ec2:RunInstances if the volume encryption key is not the required key
SCPs can enforce key usage across the account.
B
Create an IAM role that requires the ec2:RunInstances action to include the kms:KeyId condition
Why wrong: IAM roles are not used to enforce encryption policies.
C
Configure the KMS key policy to allow only the specific key for EBS encryption
Why wrong: Key policy does not enforce which key is used at launch.
D
Enable encryption by default for EBS volumes in the account
Why wrong: Default encryption uses the default KMS key, not a specific one.

Question 15hardmultiple choice

A company stores sensitive data in an S3 bucket with versioning enabled. They want to ensure that objects are encrypted at rest using SSE-KMS. A security audit reveals that some older object versions are encrypted with SSE-S3. What is the MOST efficient way to re-encrypt those older versions with SSE-KMS?

Trap 1: Create a lifecycle policy to transition objects to a new storage…

Lifecycle does not change encryption.

Trap 2: Use the AWS CLI s3 sync command with the --sse aws:kms option

Sync does not work on versions.

Trap 3: Manually re-upload the objects via the S3 console

Manual process is not efficient.

A
Create a lifecycle policy to transition objects to a new storage class
Why wrong: Lifecycle does not change encryption.
B
Use the AWS CLI s3 sync command with the --sse aws:kms option
Why wrong: Sync does not work on versions.
C
Use S3 Batch Operations to copy objects with SSE-KMS encryption
Batch Operations can re-encrypt objects in place.
D
Manually re-upload the objects via the S3 console
Why wrong: Manual process is not efficient.

Question 16easymultiple choice

A company needs to ensure that data in transit between an on-premises data center and Amazon S3 is encrypted. Which AWS service should be used to establish a dedicated encrypted connection?

Trap 1: AWS Transit Gateway

Central hub, not a connection type.

Trap 2: AWS Site-to-Site VPN

Uses public internet.

Trap 3: AWS Client VPN

For remote users.

A
AWS Transit Gateway
Why wrong: Central hub, not a connection type.
B
AWS Site-to-Site VPN
Why wrong: Uses public internet.
C
AWS Direct Connect with VPN
Dedicated private connection with encryption.
D
AWS Client VPN
Why wrong: For remote users.

Question 17hardmultiple choice

A company is designing a data protection strategy for an Amazon RDS for MySQL database. The database is 2 TB in size and stores financial data. The compliance team requires that database snapshots be encrypted at rest and that encryption keys be rotated every year. Which solution meets these requirements with the LEAST operational overhead?

Trap 1: Copy each snapshot to a new snapshot encrypted with a new KMS key

Manual process for each snapshot.

Trap 2: Export snapshots to S3 and use S3 Batch Operations to re-encrypt…

High operational overhead.

Trap 3: Use a different KMS key for each snapshot and rotate the key…

Manual rotation overhead.

A
Copy each snapshot to a new snapshot encrypted with a new KMS key
Why wrong: Manual process for each snapshot.
B
Export snapshots to S3 and use S3 Batch Operations to re-encrypt them
Why wrong: High operational overhead.
C
Use a different KMS key for each snapshot and rotate the key manually
Why wrong: Manual rotation overhead.
D
Enable automatic key rotation in AWS KMS for the KMS key used for RDS encryption
Automatic rotation meets requirement with minimal overhead.

Read the full NAT/PAT explanation →

Question 18easymulti select

A company wants to protect data at rest for an Amazon S3 bucket that contains sensitive data. Which combination of actions provides the MOST comprehensive protection? (Choose two.)

Trap 1: Enable versioning on the bucket

Versioning does not encrypt.

Trap 2: Enable MFA Delete on the bucket

MFA Delete does not provide encryption.

Trap 3: Configure a lifecycle policy to transition objects to Glacier

Lifecycle does not encrypt.

A
Enable versioning on the bucket
Why wrong: Versioning does not encrypt.
B
Enable default encryption on the bucket with SSE-S3
Ensures encryption at rest.
C
Configure a bucket policy to deny requests over HTTP
Ensures encryption in transit.
D
Enable MFA Delete on the bucket
Why wrong: MFA Delete does not provide encryption.
E
Configure a lifecycle policy to transition objects to Glacier
Why wrong: Lifecycle does not encrypt.

Question 19hardmultiple choice

A company uses AWS KMS to encrypt data in Amazon S3. The security team receives an alert that an IAM user is attempting to decrypt data using a key that they do not have access to. Which AWS service can be used to monitor and alert on such unauthorized KMS API calls?

Trap 1: Amazon GuardDuty

GuardDuty does not monitor specific KMS API calls.

Trap 2: AWS Config

Config monitors resource changes, not API calls.

Trap 3: Amazon Inspector

Inspector is for security assessments.

A
Amazon GuardDuty
Why wrong: GuardDuty does not monitor specific KMS API calls.
B
AWS Config
Why wrong: Config monitors resource changes, not API calls.
C
AWS CloudTrail with CloudWatch Alarms
CloudTrail logs KMS actions; alarms can be set on specific events.
D
Amazon Inspector
Why wrong: Inspector is for security assessments.

Question 20easymultiple choice

A company needs to encrypt data in transit between an EC2 instance and an RDS database. Which option should be used?

Trap 1: Enable encryption at rest for the RDS instance

Encryption at rest does not protect in transit.

Trap 2: Use an AWS KMS key to encrypt the connection

KMS is for key management, not transit encryption.

Trap 3: Enable EBS encryption on the EC2 instance

EBS encryption is at rest.

A
Enable encryption at rest for the RDS instance
Why wrong: Encryption at rest does not protect in transit.
B
Configure the database to use SSL/TLS connections
SSL/TLS encrypts data in transit.
C
Use an AWS KMS key to encrypt the connection
Why wrong: KMS is for key management, not transit encryption.
D
Enable EBS encryption on the EC2 instance
Why wrong: EBS encryption is at rest.