Data Protection — SCS-C02 Practice Quiz

Question 1

A security team runs a public-facing web application behind an Application Load Balancer (ALB) that terminates TLS using a certificate provisioned by AWS Certificate Manager (ACM). A PCI DSS audit requires that the application no longer negotiate TLS 1.0 or TLS 1.1 and must reject weak ciphers, while still supporting modern browsers. What is the MOST appropriate action to enforce this requirement?

Accepted Answer

Update the HTTPS listener on the ALB to use a predefined ELB security policy that only permits TLS 1.2 and above.

Answer

Reissue the ACM certificate with a stronger key algorithm so that older TLS versions are automatically disabled.

Answer

Attach an AWS WAF rule to the ALB that inspects the TLS handshake and blocks connections using TLS 1.0 or 1.1.

Answer

Enable AWS Config managed rules to detect and automatically remediate the certificate's supported protocol versions.

Question 2

A media company hosts a static website in an S3 bucket served through a CloudFront distribution. The web team, which operates primarily in the eu-west-1 Region, requests an ACM certificate for their custom domain so that the distribution can serve HTTPS traffic. They created a public certificate in ACM in eu-west-1, validated it via DNS, and confirmed its status is 'Issued'. However, the certificate does not appear as a selectable option when they attempt to associate it with the CloudFront distribution. What is the cause and correct remediation?

Accepted Answer

CloudFront only supports certificates that are stored in ACM in the us-east-1 (N. Virginia) Region; request or import the certificate in us-east-1 and associate it with the distribution.

Answer

The certificate must be exported from ACM and manually uploaded to CloudFront, because CloudFront cannot reference ACM-managed certificates directly.

Answer

CloudFront requires certificates issued by AWS Private CA rather than public ACM certificates; reissue the certificate using a private CA.

Answer

The certificate's DNS validation must be redone using email validation, because CloudFront ignores DNS-validated ACM certificates.

Question 3

A company runs a public-facing application behind an Application Load Balancer. The security team uses an SSL/TLS certificate that was issued by the company's existing third-party certificate authority and then imported into AWS Certificate Manager (ACM). During an audit, the team is concerned about a repeat of a past incident where the certificate expired and caused an outage. Which approach ensures they are proactively warned before this imported certificate expires?

Accepted Answer

Use the ACM-provided Amazon CloudWatch metric 'DaysToExpiry' and configure a CloudWatch alarm (or an EventBridge rule for the ACM expiration event) to notify the team before expiry.

Answer

Rely on ACM to automatically renew the imported certificate 60 days before expiration, as it does for all certificates in ACM.

Answer

Enable AWS Config managed rule 'acm-certificate-rsa-check' to force renewal of the imported certificate automatically.

Answer

Migrate the certificate's private key into AWS Secrets Manager and enable automatic rotation to replace the certificate before it expires.

Question 4

A company runs a public-facing REST API behind an Application Load Balancer (ALB). Security requires that the TLS private key used to terminate connections is never exportable or accessible to administrators, and that certificate renewal happens automatically without operator intervention. The team currently uses a certificate issued by a public third-party certificate authority that they trust. Which approach best meets all requirements?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) for the domain and associate it with the ALB listener, allowing ACM to manage the private key and renewal.

Answer

Import the existing third-party certificate and private key into ACM and associate it with the ALB, relying on ACM to rotate the key automatically.

Answer

Store the third-party private key in AWS Secrets Manager, enable automatic rotation, and reference the secret from the ALB listener configuration.

Answer

Upload the certificate and private key to IAM as a server certificate and attach it to the ALB, using IAM access policies to prevent administrators from reading the key.

Question 5

A financial services company runs a fleet of internal microservices on EC2 instances behind internal Application Load Balancers within a private VPC. Security policy requires mutual TLS between all internal services using X.509 certificates issued by a certificate authority the company controls. The certificates must be short-lived and automatically renewed, and the CA's root must NOT be publicly trusted. Which solution best meets these requirements?

Accepted Answer

Deploy AWS Private CA (ACM Private CA) as the internal root/subordinate hierarchy, issue certificates through ACM for the ALBs, and distribute the private CA root to services for trust validation.

Answer

Use AWS Certificate Manager (ACM) public certificates for each service and configure the internal ALBs to require client certificates.

Answer

Store self-signed certificates in AWS Secrets Manager and configure a Lambda rotation function to replace them every 24 hours on each service.

Answer

Purchase certificates from a third-party public CA and import them into ACM, then attach them to the internal ALBs for mutual TLS.

Question 6

A financial services company must implement a data classification strategy for a data lake in Amazon S3 containing millions of objects. Objects classified as 'Restricted' (containing PII) must be encrypted with a dedicated customer managed KMS key and retained for 7 years, while 'Internal' objects can use SSE-S3 and transition to cheaper storage after 90 days. The security team wants classification to drive these downstream controls automatically as new objects arrive, with minimal ongoing manual effort. Which approach best meets these requirements?

Accepted Answer

Use Amazon Macie to discover and classify sensitive data, apply object tags based on findings, and use S3 Lifecycle rules and separate buckets with tag-based bucket policies to enforce KMS encryption and tiering per classification.

Answer

Enable S3 default encryption with a single customer managed KMS key on the bucket and configure one Lifecycle rule to transition all objects to S3 Glacier Deep Archive after 90 days.

Answer

Manually review a sample of objects each quarter, tag them by hand, and rely on IAM policies to control which analysts can access Restricted data.

Answer

Turn on S3 Storage Lens with advanced metrics to identify PII and automatically re-encrypt matching objects with the dedicated KMS key.

Question 7

A financial services company stores sensitive customer transaction records in an Amazon DynamoDB table. A compliance requirement mandates that the encryption key used for data at rest must be under the company's direct control, allowing them to define key policies, audit key usage in CloudTrail, and disable the key immediately if a breach is suspected. The security team wants to minimize operational overhead while still meeting these controls. Which DynamoDB encryption-at-rest configuration should they choose?

Accepted Answer

Use a customer managed key (CMK) in AWS KMS configured for the DynamoDB table.

Answer

Use the default AWS owned key for DynamoDB encryption, which requires no configuration.

Answer

Use an AWS managed key (aws/dynamodb) so AWS handles rotation and policy management automatically.

Answer

Disable DynamoDB server-side encryption and encrypt items client-side with a locally stored key.

Question 8

A security engineer discovers that several EC2 instances in a production account were launched with unencrypted EBS root and data volumes before an encryption policy was enforced. The engineer has already enabled EBS encryption by default at the account and Region level to protect future volumes. What is the correct approach to bring the EXISTING unencrypted volumes into compliance with the encryption-at-rest requirement while minimizing data loss?

Accepted Answer

Create a snapshot of each unencrypted volume, copy the snapshot with encryption enabled using a KMS key, create new encrypted volumes from the encrypted snapshots, and attach them to the instances.

Answer

Enabling EBS encryption by default automatically encrypts all existing unencrypted volumes during the next instance stop/start cycle, so no further action is needed.

Answer

Use the ModifyVolume API to set the Encrypted attribute to true on each existing volume in place, which encrypts the data without detaching the volume.

Answer

Apply an S3 bucket policy that enforces SSE-KMS to the volumes, since EBS volumes are stored as objects in an underlying S3 bucket.

Question 9

A financial services company must digitally sign outbound payment files so that external partners can cryptographically verify the files came from the company and were not altered. Partners do not have AWS accounts and must be able to verify signatures using standard tooling without contacting AWS. The signing private key must never leave AWS and must be protected by FIPS 140-2 validated hardware. Which approach meets these requirements?

Accepted Answer

Create an asymmetric KMS key with key usage SIGN_VERIFY, sign files by calling the KMS Sign API, and distribute the public key to partners so they can verify signatures offline.

Answer

Create a symmetric KMS key and generate HMAC tags for each file, then share the symmetric key material with partners so they can recompute the HMAC.

Answer

Store an RSA private key in AWS Secrets Manager, retrieve it in a Lambda function to sign files, and publish the corresponding public key to partners.

Answer

Create an asymmetric KMS key with key usage ENCRYPT_DECRYPT, encrypt files with the private key, and give partners the public key to decrypt and confirm origin.

Question 10

A company's production account (Account A) encrypts EBS snapshots with a customer managed KMS key. The DR team in a separate account (Account B) needs to copy these shared snapshots and restore volumes from them in Account B. The security team has already shared the snapshots with Account B via the snapshot sharing feature. However, when Account B attempts to copy the snapshot, the operation fails with an access denied error. What must the security team configure to allow Account B to successfully copy and restore the encrypted snapshots while following least privilege?

Accepted Answer

Update the KMS key policy in Account A to grant Account B the permissions kms:DescribeKey, kms:CreateGrant, kms:Decrypt, and kms:ReEncrypt*, and ensure the IAM principal in Account B has matching KMS permissions in its identity policy.

Answer

Disable encryption on the source snapshots in Account A before sharing them, so Account B can copy plaintext snapshots without needing KMS access.

Answer

Enable automatic key rotation on the KMS key in Account A, which propagates the rotated key material to Account B and grants implicit cross-account decrypt access.

Answer

Add Account B as a principal in a resource policy on the EBS snapshot itself, granting ec2:CopySnapshot and ec2:CreateVolume permissions.

Question 11

A financial services company must meet a regulatory requirement that all cryptographic key material used to encrypt customer data at rest be stored in single-tenant, FIPS 140-2 Level 3 validated hardware that the company controls, while still using AWS KMS APIs for envelope encryption across services such as S3 and EBS. Which approach satisfies this requirement with the least custom integration effort?

Accepted Answer

Create a KMS custom key store backed by an AWS CloudHSM cluster and generate KMS keys within that key store.

Answer

Import your own key material into a standard AWS-managed KMS key using the BYOK import feature.

Answer

Use AWS KMS multi-Region keys so key material is replicated to hardware in each Region the company operates in.

Answer

Enable automatic annual key rotation on a standard KMS symmetric key to satisfy the hardware isolation requirement.

Question 12

A media company must encrypt very large video files (several GB each) on-premises before uploading them to Amazon S3. Compliance requires that the plaintext data key never leave the application and that encryption happen entirely client-side using a customer managed KMS key. The team wants to avoid sending the multi-GB payloads to KMS. Which approach correctly meets these requirements?

Accepted Answer

Use the AWS Encryption SDK, which calls KMS GenerateDataKey to obtain a plaintext and encrypted data key, encrypts the file locally with the plaintext key, then discards the plaintext key and stores the encrypted data key with the ciphertext.

Answer

Call the KMS Encrypt API directly with the full video file as the plaintext parameter, using the customer managed key.

Answer

Enable S3 default encryption with SSE-KMS on the bucket so the objects are encrypted with the customer managed key after upload.

Answer

Use SSE-C by generating a 256-bit key in the application and passing it in the request headers on each S3 PutObject call.

Question 13

A security engineer is designing envelope encryption for a multi-tenant SaaS application. Each tenant's data is encrypted with a shared AWS KMS customer managed key. The engineer wants to ensure that ciphertext encrypted for one tenant cannot be decrypted while claiming a different tenant's identity, without creating a separate KMS key per tenant. Which approach best achieves this cryptographic binding?

Accepted Answer

Pass an encryption context containing the tenant ID on every Encrypt and Decrypt call, and enforce the matching context in the KMS key policy conditions.

Answer

Store each tenant ID as a resource tag on the KMS key and rely on ABAC to isolate decrypt operations.

Answer

Enable automatic key rotation so each tenant receives a distinct backing key version.

Answer

Use a KMS grant per tenant that includes the tenant ID in the grant name to scope decryption.

Question 14

A company runs a data-processing Lambda function that must decrypt objects protected by a customer managed KMS key only during a nightly batch job. The security team wants to grant the Lambda execution role temporary, least-privilege decrypt access without modifying the key policy each time and without leaving standing permissions that must be manually removed. The key policy already delegates permissions management to IAM. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant to the Lambda execution role that allows the Decrypt operation, and retire the grant when the batch job completes.

Answer

Add the Lambda execution role as a principal with kms:Decrypt in the key policy, then remove it after each run.

Answer

Attach an IAM policy to the Lambda execution role that permanently allows kms:Decrypt on the key.

Answer

Enable automatic key rotation so a new key version is available for each nightly job.

Question 15

A financial services company must retain full control over the cryptographic material used to encrypt sensitive data in Amazon S3. To meet compliance, they create a KMS key with an origin of EXTERNAL and import their own 256-bit key material, setting it to expire after 90 days. As the expiration date approaches, the security team wants to ensure encrypted objects remain decryptable without disruption. Which action correctly extends the ability to use this key?

Accepted Answer

Reimport the exact same key material into the existing KMS key before or after expiration, optionally setting a new expiration date.

Answer

Enable automatic annual key rotation on the KMS key so AWS generates new material before expiration.

Answer

Create a new KMS key with imported material and re-encrypt all existing S3 objects before the old key expires.

Answer

Use the ImportKeyMaterial API to import a new, different 256-bit key into the same key to replace the expiring material.

Question 16

A security engineer accidentally scheduled deletion of a customer managed KMS key that is used to encrypt production RDS snapshots and several S3 objects. The deletion was scheduled with the default waiting period. The team realizes the mistake two days later and is worried about permanently losing the ability to decrypt data. What is the correct action to prevent data loss?

Accepted Answer

Cancel the scheduled key deletion, which returns the key to the Disabled state, then re-enable the key so it can be used for decryption again.

Answer

Create a new KMS key with the same key material and update the RDS and S3 configurations to reference it before the deletion completes.

Answer

Immediately export the existing key material from KMS and re-import it into a new key to preserve decryption capability.

Answer

Contact AWS Support to halt the deletion because scheduled key deletions cannot be canceled by customers once initiated.

Question 17

A security engineer manages a single KMS customer managed key used by multiple project teams. The compliance team requires that each team can only use the key to encrypt/decrypt data associated with their own project, distinguished by a request tag. The engineer wants to control this authorization through the KMS key policy without creating a separate key per team. Which approach correctly enforces per-team access using KMS cryptographic operations?

Accepted Answer

Add a key policy statement allowing kms:Encrypt and kms:Decrypt with a condition on kms:EncryptionContext that must match the caller's project identifier.

Answer

Create a separate KMS alias for each team and add a key policy condition on kms:RequestAlias so teams can only invoke the key through their own alias.

Answer

Enable automatic key rotation and rely on the rotated key versions to separate each team's ciphertext.

Answer

Attach a resource-based policy to the ciphertext objects in S3 referencing each team's IAM role for decrypt permission.

Question 18

A financial services company stores sensitive customer records in an Amazon RDS database encrypted with a customer managed KMS key. The security team wants to enforce a data classification policy that guarantees the KMS key used to encrypt this data can ONLY be used to protect data at rest and is never used for signing or MAC operations, regardless of any future key policy changes. Which approach BEST enforces this constraint at the KMS layer?

Accepted Answer

Create the KMS key as a symmetric encryption key (key usage ENCRYPT_DECRYPT), since key usage and key spec are set at creation time and are immutable.

Answer

Add a key policy statement that denies kms:Sign and kms:GenerateMac actions for all principals.

Answer

Attach an SCP to the organization denying kms:Sign and kms:Verify on the key ARN.

Answer

Enable automatic key rotation so that new key material cannot be repurposed for signing operations.

Question 19

A financial services company stores customer records in an S3 bucket encrypted with a customer managed KMS key in Account A. A partner analytics firm operating in Account B must be able to decrypt and read these objects, but must NOT be able to schedule deletion of the key, change the key policy, or create grants on the key. The security team wants to grant the minimum access using the KMS key policy while allowing Account B's own IAM administrators to delegate the decrypt permission to specific roles. Which approach meets these requirements?

Accepted Answer

In the KMS key policy, add a statement allowing the Account B root principal (arn:aws:iam::AccountB:root) the kms:Decrypt and kms:DescribeKey actions, then have Account B attach IAM policies granting those actions to specific roles.

Answer

In the KMS key policy, add a statement allowing specific Account B IAM roles all kms:* actions, relying on Account B IAM policies to further restrict which roles can use the key.

Answer

Create a KMS grant that gives the Account B root principal kms:Decrypt, kms:CreateGrant, and kms:ScheduleKeyDeletion so Account B can manage its own delegation.

Answer

Enable automatic key rotation and share the key's backing key material with Account B so the partner can decrypt objects independently without cross-account policy changes.

Question 20

A company encrypts objects in an S3 bucket in Account A using a customer managed KMS key. A data-analytics application running under an IAM role in Account B must be able to read and decrypt these objects. The security team wants to grant the minimum access required and follow AWS best practices for cross-account KMS access. Which combination of configuration steps correctly enables Account B to decrypt the objects?

Accepted Answer

In the KMS key policy in Account A, add a statement allowing the Account B role kms:Decrypt; in Account B, attach an IAM policy allowing kms:Decrypt on the key ARN; and grant the role s3:GetObject on the bucket.

Answer

Enable automatic key rotation on the KMS key and add the Account B role as a key administrator in the key policy.

Answer

Attach an IAM policy to the Account B role allowing kms:Decrypt on the key ARN; no changes to the key policy in Account A are needed because IAM policies override key policies across accounts.

Answer

Share the KMS key with Account B using AWS Resource Access Manager (RAM) and enable S3 Bucket Keys on the bucket.

More SCS-C02 practice