CCNA Data Protection Questions

Option C is correct because using a KMS key with a key policy that grants decrypt only to the specific IAM role ensures that only that role can decrypt, while the bucket policy restricts who can access the bucket. Option A is wrong because the bucket policy alone cannot control decryption. Option B is wrong because S3 default encryption does not restrict decryption.

Option D is wrong because KMS automatic key rotation does not control access.

Option B is correct because ACM can issue public certificates from trusted CAs at no cost, and they can be automatically renewed. Option A is wrong because importing a certificate requires manual renewal. Option C is wrong because CloudHSM is not needed for this.

Option D is wrong because CloudFront is unnecessary overhead.

AWS CloudTrail logs all KMS API calls. Option B is correct. Option A is incorrect because CloudWatch Logs can store logs but does not generate them.

Option C is incorrect because AWS Config tracks resource configuration, not API calls. Option D is incorrect because VPC Flow Logs capture network traffic, not KMS operations.

Amazon Macie uses machine learning to discover and classify sensitive data. Option B is correct. Option A is incorrect because GuardDuty is for threat detection.

Option C is incorrect because Inspector is for vulnerability assessment. Option D is incorrect because Artifact provides compliance reports.

Option C (Use a cross-Region read replica with encryption enabled) is correct because it replicates data to another Region and encryption can be enabled. Option A is wrong because enabling encryption on an existing unencrypted DB instance is not supported. Option B is wrong because a snapshot copy with encryption can be restored but does not provide continuous replication.

Option D is wrong because S3 is not used for RDS backups directly.

Option C is correct. With MFA Delete enabled, deleting an object version requires MFA in the request. Since the user did not provide MFA, the request will be denied with an AccessDenied error.

Option A is wrong because the object version is not deleted. Option B is wrong because the object version is not marked for deletion. Option D is wrong because lifecycle rules do not apply to manual delete requests.

The policy denies PutObject if the encryption header is not equal to 'aws:kms'. Since the developer uses AES256, the condition StringNotEquals evaluates to true, so the Deny applies. Upload fails.

Option B is correct. Option A is wrong because AES256 is not allowed. Option C is wrong because the request is denied.

Option D is wrong because there is no policy that allows only SSE-KMS; the Deny applies.

Options A and C are correct. Option A: Setting a key policy that denies use by external accounts prevents cross-account usage. Option C: Using key policies to restrict usage to specific IAM roles within the account ensures only authorized roles can use the key.

Option B is wrong because disabling key rotation does not prevent cross-account use. Option D is wrong because enabling automatic rotation does not restrict usage. Option E is wrong because tagging keys does not prevent usage.

Option D is correct because an S3 bucket policy that denies PutObject if the object is not encrypted ensures that only encrypted objects can be uploaded. Option A is wrong because enabling default encryption does not prevent unencrypted uploads if the request explicitly sets encryption to none. Option B is wrong because AWS Config can detect but not deny the upload.

Option C is wrong because S3 does not have an 'encryption required' bucket policy; the correct approach is to deny unencrypted uploads.

Option B is correct because using HTTPS (TLS) encrypts data in transit between the client and S3. Option A is wrong because S3 does not support IPsec VPN directly for object uploads. Option C is wrong because VPC endpoints encrypt traffic within AWS, but not the on-premises connection.

Option D is wrong because S3 Transfer Acceleration speeds up transfers but does not provide encryption; HTTPS is still needed.

Options A and C are correct encryption methods provided by S3. Option B is for client-side, but not S3's own encryption. Option D is for data in transit.

Option E is for masking, not encryption.

Options A and D are correct. A key policy that grants decrypt permission to a specific account (option A) and an IAM policy in the target account that allows the user to call KMS Decrypt (option D) are both required. Option B is wrong because an S3 bucket policy does not control KMS decryption.

Option C is wrong because S3 default encryption only sets server-side encryption, not cross-account restrictions. Option E is wrong because using a different KMS key for each object is unnecessary and complex.

Using key policies to restrict which IAM roles can use the key (Option A) and enabling key rotation to limit the window of compromise (Option D) are effective. Granting broad access (Option B) is not recommended. Deleting unused keys (Option C) does not prevent unauthorized use of remaining keys.

Using aliases (Option E) does not control access.

Options B and D are correct. Option B: Enabling default encryption ensures that new objects are automatically encrypted. Option D: Using S3 Block Public Access prevents accidental public exposure.

Option A is wrong because S3 Transfer Acceleration is for speed, not security. Option C is wrong because S3 event notifications are for automation, not protection. Option E is wrong because S3 Object Lock prevents deletion/modification, not unauthorized access.

Option A is correct because to share an encrypted AMI, you must share the AMI, the snapshot, and the KMS key with the target account. Option B is incorrect because the target account cannot use its own KMS key to decrypt a snapshot encrypted with a different key. Option C is incorrect because sharing the AMI alone is insufficient.

Option D is incorrect because the source account must grant decrypt permissions; the target account does not need to create a snapshot.

To enforce SSE-KMS, use a bucket policy that denies PutObject without the x-amz-server-side-encryption header set to aws:kms and a specific key. To control decryption, grant kms:Decrypt to the specific role. Option A, C, and D are correct.

Option B is incorrect because using SSE-S3 does not meet the requirement. Option E is incorrect because client-side encryption is not S3 server-side encryption.

Option A is correct because MFA Delete adds an extra factor for deletions, and versioning allows recovery of deleted objects. Option B is wrong because Object Lock prevents overwrites/deletion only if retention period is set, but doesn't prevent deletion of the bucket. Option C is wrong because replication doesn't protect against deletion.

Option D is wrong because default encryption doesn't prevent deletion.

Option A is correct because if the user does not include the --sse-customer-key parameter or the correct encryption context, S3 may not decrypt. However, for SSE-KMS, S3 automatically decrypts if the user has kms:Decrypt permission. The issue might be that the user is using a different tool or not specifying the correct headers.

Option B is wrong because SSE-KMS does not require a customer key. Option C is wrong because S3 handles decryption transparently. Option D is wrong because the user has the decrypt permission.

Option D is correct because using 's3:x-amz-server-side-encryption' condition with 'aws:kms' enforces that server-side encryption with KMS is used. Option A is wrong because it enforces SSE-S3. Option B is wrong because it enforces SSE-C.

Option C is wrong because it checks the KMS key ID but not the encryption method.

Option D is correct because Amazon Macie uses machine learning and pattern matching to discover sensitive data such as PII in S3. Option A is wrong because AWS Config evaluates resource configurations, not data content. Option B is wrong because Amazon GuardDuty detects threats, not PII.

Option C is wrong because AWS CloudTrail logs API calls, not data content.

Option C is correct because AWS KMS uses envelope encryption and supports custom key stores backed by CloudHSM, which is FIPS 140-2 Level 3 validated. Option A is wrong because KMS default key store uses FIPS 140-2 Level 2 validated HSMs. Option B is wrong because CloudHSM alone does not provide envelope encryption; you would need to implement it yourself.

Option D is wrong because S3 does not have a built-in envelope encryption feature.

Option D is correct because an SCP can deny ec2:RunInstances if the volume encryption key is not the required key. Option A is wrong because IAM roles do not enforce encryption at launch. Option B is wrong because KMS key policies control who can use the key, not which key is used.

Option C is wrong because default encryption uses the account's default key, not necessarily the required key.

Option B is correct because the command uses KMS to encrypt the contents of secret.txt and writes the base64-decoded ciphertext to a file. Option A is about decrypting. Option C is about generating a data key.

Option D is about re-encrypting.

Option B is correct because EFS supports encryption at rest using KMS. Option D is correct because encryption in transit can be enforced using a mount option. Option A is wrong because EFS does not support versioning.

Option C is wrong because EFS does not have Block Public Access; it uses security groups. Option E is wrong because EFS does not use lifecycle policies for data protection; they manage storage tiers.

Options A and D are correct because enabling automatic key rotation in KMS rotates the key material annually (but not 90 days), and re-encrypting existing objects with the new key ensures they are encrypted with the latest key. Option B is incorrect because deleting the old key breaks access. Option C is incorrect because S3 does not automatically re-encrypt.

Option E is incorrect because manual rotation every 90 days is not necessary if automatic rotation is enabled, and re-encryption is needed.

Customer managed keys (CMKs) support optional automatic rotation every year. AWS managed keys rotate automatically every 3 years but cannot be configured. Option B is correct.

Option A is incorrect because AWS managed keys rotate every 3 years, not 12 months. Option C is incorrect because custom key store keys do not support automatic rotation. Option D is incorrect because imported key material does not support automatic rotation.

Option B is correct because AWS KMS supports automatic key rotation for customer managed keys (CMKs) when enabled. Option A is incorrect because automatic rotation is available for CMKs, not just AWS managed keys. Option C is incorrect because manual rotation is not required.

Option D is incorrect because rotation is independent of CloudTrail.

Option A is correct because RDS supports encryption at rest for new databases using AWS KMS. Option B is incorrect because there is no separate encryption layer; RDS uses KMS. Option C is incorrect because application-level encryption is not the simplest.

Option D is incorrect because RDS does not support CloudHSM for encryption at rest.

Option C is correct because the Lambda function needs permissions to read the secret and update the database. Option A is not about rotation. Option B would cause an unrelated error.

Option D is about encryption key permissions, but the error is about accessing the secret.

Option B is correct. The policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256, thus enforcing SSE-S3 encryption on all uploads. Option A is wrong because it does not enforce SSE-KMS.

Option C is wrong because the condition checks for AES256, not for the absence of encryption. Option D is wrong because the policy denies unencrypted uploads, not allows them.

Option D is correct because using a KMS key policy that grants kms:Decrypt only to the specific roles ensures that only those roles can decrypt. Option A is wrong because an S3 bucket policy controls access to S3 operations, not KMS decryption. Option B is wrong because an IAM policy that allows kms:Decrypt for all users would not restrict to specific roles.

Option C is wrong because a KMS grant is a temporary permission, not a permanent policy.

Option B is correct because CloudHSM supports backup and restore between clusters. Option A is wrong because CloudHSM is single-region. Option C is wrong because keys are stored in the HSM.

Option D is wrong because KMS does not import keys from CloudHSM automatically.

Option C is correct because RDS automatically encrypts snapshots and backups when the source database is encrypted. No additional steps are needed. Option A is wrong because encryption is already inherited.

Option B is wrong because the same KMS key is used by default. Option D is wrong because enabling encryption on a non-encrypted instance requires a snapshot copy with encryption.

Option C is correct because AWS Secrets Manager securely stores secrets and supports automatic rotation. Option A is wrong because Systems Manager Parameter Store can store secrets but does not automatically rotate them without custom logic. Option B is wrong because IAM roles cannot store database credentials.

Option D is wrong because KMS is a key management service, not a secret store.

AWS CloudTrail captures API calls to AWS services, including KMS Decrypt. CloudTrail logs can be delivered to S3 for analysis. Option C is correct.

CloudWatch Logs can receive logs but does not directly capture KMS API calls; S3 server access logs do not include KMS decryption events; VPC Flow Logs capture network traffic, not API calls.

Option A is correct because enabling encryption on the RDS instance uses KMS, and manual snapshots inherit the same KMS key. Key rotation can be enabled in KMS. Option B is wrong because AWS managed keys cannot be rotated on a custom schedule; they rotate automatically every year, but the customer cannot control the rotation.

Option C is wrong because S3 server-side encryption does not apply to RDS backups. Option D is wrong because enabling encryption on a read replica does not encrypt the source instance backups.

Options A, C, and E are correct. Scheduling key deletion with a waiting period, using CloudTrail to monitor deletion attempts, and using CloudWatch to alarm on key deletion actions provide protection. Option B is incorrect because IAM policies can prevent deletion but do not enforce a retention period.

Option D is incorrect because automatic rotation does not prevent deletion.

Option B is correct because automated backups inherit the encryption setting from the DB instance; if the DB instance is not encrypted, automated backups will not be encrypted. Option A is wrong because automated backups are stored in S3 but still encrypted with the same KMS key if the DB instance is encrypted. Option C is wrong because RDS automatically manages backup encryption; there is no separate backup encryption toggle.

Option D is wrong because the DB instance would fail to encrypt if the key is disabled.

Option C is correct because Secrets Manager publishes CloudWatch metrics for rotation success and failure. Option A is incorrect because KMS key usage metrics are not specific to rotation. Option B is incorrect because Lambda function invocations may not capture all failures.

Option D is incorrect because RDS metrics do not include Secrets Manager rotation status.

When using a VPC endpoint, the S3 bucket policy must include the condition aws:SourceVpce to allow access from the specific endpoint. If the condition is missing or incorrect, access is denied even if the IAM role allows it. Option C is correct.

The IAM role being incorrect would cause a different error; the endpoint policy might override but the bucket policy is the primary issue; the security group might block network access but the error is AccessDenied from S3, not network timeout.

Option B is correct because enabling encryption at rest for RDS automatically encrypts snapshots and backups, and cross-region read replicas can be created from an encrypted source. Option A is wrong because encrypting after creation is not directly supported; you would need to create a new encrypted instance. Option C is wrong because RDS does not support different KMS keys for the replica; it must use the same key or a replica key in the destination region.

Option D is wrong because enabling encryption after creation is not supported without creating a new instance.

Option B is correct because it allows creating a new encrypted volume and attaching it to the instance without significant downtime (a few minutes for detachment/attachment). Option A is wrong because enabling encryption on an existing volume is not supported. Option C is wrong because stopping the instance and creating an encrypted snapshot/volume would cause more downtime (stop/start).

Option D is wrong because migrating to a new instance would require additional setup and likely more downtime.

Option A is correct because the key policy allows the role to encrypt, and the IAM policy also allows. Option B is wrong because the key policy does not require additional conditions. Option C is wrong because the role is in the same account, and the key policy allows it.

Option D is wrong because the key policy is sufficient.

Option B is correct because DynamoDB supports encryption at rest with a customer-managed KMS key, and KMS supports automatic annual rotation for customer-managed keys. Option A is wrong because DynamoDB does not use CloudHSM. Option C is wrong because automatic rotation is not available for AWS managed keys (which DynamoDB uses by default).

Option D is wrong because you cannot enable encryption on a table created without encryption except by recreating it.

Option B is correct because SSE-KMS provides separate permissions for key usage and audit trails. Option A is wrong because both provide encryption. Option C is wrong because SSE-KMS can have additional cost.

Option D is wrong because SSE-S3 also provides strong encryption.

Option C is correct because CloudTrail can be configured to use SSE-KMS for encryption, and log file integrity validation provides tamper detection. Option A is wrong because CloudWatch Logs does not provide integrity validation. Option B is wrong because S3 server access logs are not for CloudTrail.

Option D is wrong because CloudHSM does not integrate directly with CloudTrail.

CloudWatch Logs uses a service-linked role to write logs. To restrict writing to the Lambda service, you need to add a condition to the key policy that allows the logs service only when the request comes from Lambda. Option C is correct.

Option A is incorrect because a bucket policy is for S3. Option B is incorrect because resource-based policies on log groups are for cross-account access, not to restrict write access. Option D is incorrect because IAM roles cannot be assigned to log groups.

Option D is correct because you can enable EBS encryption by default for the region, which automatically encrypts new volumes. Option A is wrong because you cannot encrypt an existing volume directly; you must create a snapshot and restore. Option B is wrong because encryption at the application layer is not a storage encryption method.

Option C is wrong because instance store volumes are not persistent and encryption is not managed by EBS.

Option C is correct because using kms:ViaService restricts key usage to DynamoDB, and the key policy grants decrypt to the role. Option A is wrong because IAM policy alone is insufficient; the key policy must allow. Option B is wrong because it doesn't restrict to DynamoDB.

Option D is wrong because grants are not typically used for service-level restrictions.

Option B is correct because AES256 refers to SSE-S3 encryption. Option A is incorrect because SSE-KMS uses 'aws:kms'. Option C is incorrect because SSE-C is not set by default.

Option D is incorrect because client-side encryption is not a server-side feature.

Option A is correct because Glacier automatically encrypts data at rest using SSE-S3 with keys rotated annually by AWS. Option C is correct because SSE-KMS with automatic key rotation also meets the requirement. Option B is wrong because SSE-C does not provide automatic rotation.

Option D is wrong because CloudHSM requires manual rotation. Option E is wrong because client-side encryption does not use S3's server-side encryption.

Options A and C are correct. Enabling default encryption (A) ensures data at rest is encrypted. Enforcing HTTPS (C) protects data in transit.

Option B is incorrect because MFA delete does not protect data in transit or at rest. Option D is incorrect because S3 Access Logs are for auditing, not protection. Option E is incorrect because pre-signed URLs still use HTTPS if enforced, but they do not protect data at rest.

Option B is correct because AWS CloudTrail logs all KMS API calls, including Decrypt, Encrypt, GenerateDataKey, and any authorization failures. Option A is wrong because CloudWatch Logs is for monitoring log data, not for capturing API calls. Option C is wrong because Amazon GuardDuty is a threat detection service that does not log KMS API calls.

Option D is wrong because AWS Config tracks resource configuration changes, not API calls.

Option C is correct because kms:EncryptionContextKeys is the condition key that allows you to require a specific encryption context in KMS operations. Option A is wrong because s3:x-amz-server-side-encryption is for requiring SSE. Option B is wrong because kms:ViaService is for restricting KMS usage to a specific AWS service.

Option D is wrong because s3:PutObjectEncryption is not a valid condition key.

The output shows default encryption is set to SSE-S3 (AES256). This means new objects will be encrypted with SSE-S3 unless a different encryption header is provided. Option A is correct.

Option B is wrong because it's SSE-S3, not SSE-KMS. Option C is wrong because default encryption does not prevent client-side encryption. Option D is wrong because the bucket does not enforce SSE-KMS.

Option A is correct. To cryptographically erase data, you must delete the KMS key that was used to encrypt it. However, deleting a KMS key is irreversible and may affect other data.

Option B is wrong because disabling the key prevents decryption, but the encrypted data still exists. Option C is wrong because the TTL deletion does not encrypt the data. Option D is wrong because DynamoDB backups are separate; you need to delete the key or the data.

Option B is correct because enabling encryption on the DB instance at creation time encrypts the database at rest. Option A is incorrect because encryption cannot be enabled on an existing unencrypted DB instance. Option C is incorrect because encryption is not applied per database.

Option D is incorrect because RDS encryption does not require a client-side tool.

Option B is correct because the key is disabled, so decryption fails. Option A is wrong because the policy allows decrypt. Option C is wrong because the policy specifies the correct key ARN.

Option D is wrong because the key exists.

Using a key policy with a condition that allows only the specified role is the most secure way. Option A is wrong because a bucket policy alone does not control KMS key usage. Option B is wrong because IAM policies can be attached to any user/role, not restrictive enough.

Option D is wrong because disabling the key is too restrictive.

AWS managed keys (aws/s3) are automatically rotated every year. Customer managed keys (CMKs) can be rotated manually or automatically, but the question specifies automatic rotation. Option B is correct because AWS managed keys are automatically rotated.

Option A is incorrect because customer managed keys require manual rotation or enabling automatic rotation. Option C is incorrect because imported key material does not support automatic rotation. Option D is incorrect because asymmetric keys are not automatically rotated.

Option B (Set the EBS encryption by default flag at the account level) is correct because it forces all new volumes to be encrypted using the default KMS key. Option A is wrong because it requires manual intervention. Option C is wrong because it requires creating a custom volume type.

Option D is wrong because CloudWatch alarms are reactive, not preventive.