Domain 5: Data Protection

Implement data protection strategies for data at rest and in transit.

5 minutes 5 Questions

Domain 5: Data Protection is a critical component of the AWS Certified Security – Specialty (SCS-C02) exam, typically accounting for approximately 22% of the exam content. This domain focuses on ensuring the confidentiality, integrity, and availability of data at rest and in transit within AWS envi…

Concepts covered
AWS KMS (Key Management Service)AWS CloudHSMS3 Data ProtectionEBS and RDS EncryptionSecrets ManagementData in Transit Encryption (TLS)
Test mode:
Start practice test

AWS SCS-C02 - Domain 5: Data Protection Example Questions

Test your knowledge of Domain 5: Data Protection

Question 1

A company stores highly sensitive financial records in an Amazon S3 bucket. A sudden litigation requires ensuring specific existing objects are preserved indefinitely against deletion or modification by any user, including the AWS account root user. The preservation period relies entirely on the duration of the legal proceedings, which is currently unknown. Which approach satisfies this specific requirement?

Correct Answer: Apply an S3 Object Lock Legal Hold to the required objects using an IAM role with the s3:PutObjectLegalHold permission.

S3 Object Lock Legal Hold is the correct approach because it prevents object deletion or modification indefinitely without requiring a fixed retention period, which perfectly suits unforeseeable litigation durations.
Governance mode is incorrect because it allows privileged users to bypass the lock and requires a set retention timeframe. Transitioning to Glacier Vault Lock is incorrect as it applies vault level controls rather than targeting specific objects. A bucket policy is incorrect because it can be modified or bypassed by the root account.
The key concept tested is indefinite object immutability using S3 Object Lock Legal Holds.

Question 2

A team is migrating application storage to Amazon S3 and Amazon EBS. They must encrypt all data at rest using AWS KMS. The security mandate specifies that the organization must retain complete authority over the cryptographic material. The administrators require the ability to author custom key policies, define granular access controls, and explicitly trigger the deletion process for the resources. Which key configuration fulfills these operational requirements?

Correct Answer: Provision Customer managed keys to retain explicit policy and lifecycle governance

Customer managed keys are the only AWS KMS option that provides organizations with complete control over cryptographic material, allowing administrators to explicitly author custom key policies and manually schedule key deletion.
AWS managed keys are incorrect because AWS strictly dictates their key policies and lifecycle, preventing admins from authoring custom policies or deleting them. AWS owned keys are incorrect because they are managed exclusively by AWS for internal service operations and offer zero customer visibility. External keys with Amazon S3 default encryption is an invalid configuration that does not grant comprehensive lifecycle governance.
Key concept tested: Distinguishing between AWS KMS key types and their respective administrative boundaries.

Question 3

A team creates an encrypted EBS snapshot using the default AWS managed key (aws/ebs). They then attempt to copy this snapshot to a different AWS region. What must the team specify during the copy operation regarding encryption?

Correct Answer: They must select a KMS key in the destination region, since the original aws/ebs key cannot be used across regions

AWS managed KMS keys (like aws/ebs) are region-specific and cannot be used outside the region where they exist, so when copying an encrypted EBS snapshot to another region, you must specify a KMS key (either AWS managed or customer managed) that exists in the destination region.

The aws/ebs key is never replicated across regions by AWS during copy operations. Re-encrypting in the source region with a customer-managed key is unnecessary since AWS handles the re-encryption during the cross-region copy process. Multi-region keys are not required; any valid KMS key in the destination region suffices.

Key concept tested: region-bound nature of AWS managed KMS keys and cross-region EBS snapshot copy encryption requirements.

More Domain 5: Data Protection questions
339 questions (total)
Practice 100 questions
One session at a time, always new questions