Data Protection (18%)

SCS-C03 · 54 questions

• A regional clinic migrates patient records to Amazon RDS for PostgreSQL and Amazon S3. Compliance requires encryption at rest with customer-controlled keys, annual rotation without re-encrypting data, and separate audit of key use in CloudTrail. Which encryption control meets the data-at-rest requirement?
• A regional bank encrypts loan archives with KMS in eu-central-1 and must retain keys for 7 years, prove external HSM origin, and crypto-shred data on regulator order without deleting audit history. Which key-material property should the architect validate to confirm imported key material fits the retention requirement?
• A healthcare portal on an Application Load Balancer must enforce encrypted browser connections, block deprecated TLS versions, and automatically redirect cleartext requests. Auditors will test the listener configuration and cipher negotiation. Which ELB mechanism enforces encrypted transit for this workload?
• A healthcare company must replicate encrypted EBS volumes and RDS snapshots to a second Region, retain immutable backups for 90 days against ransomware, and automatically expire old recovery points. Which backup design should the storage architect implement to meet ransomware protection?
• A bank migrates a payment API behind an Application Load Balancer and must enforce TLS 1.2 or higher, forward secrecy, and redirect all port 80 traffic, with quarterly proof that weak ciphers are disabled. Auditors require centrally managed ELB configuration and TLS policy evidence. Which ELB encryption enforcement control satisfies these transit requirements?
• A government agency must use KMS keys in AWS but retain key material generated in its on-premises HSM to meet sovereignty rules, accepting manual rotation every year with defined expiration. The architect must explain key origin trade-offs to approvers. Which statement correctly describes the control for imported versus AWS-generated key material?
• A healthcare platform logs PHI in CloudWatch Logs and publishes order alerts via SNS where email bodies must hide patient IDs but retain auditability. Which data protection configuration should the engineer implement to mask sensitive data in transit through logs and notifications?
• A SaaS firm hosts an internal risk-scoring API in a service VPC that three client VPCs must reach without traversing the internet, using private DNS and endpoint policies. Client networks overlap in CIDR ranges. Which private access design meets these constraints?
• A healthcare contact center logs caller verification details to CloudWatch Logs and publishes appointment reminders through SNS, but auditors flagged national IDs and phone numbers appearing in plaintext. The team must redact PII automatically using managed detection rather than hand-written parsing code. Which control should the engineer configure to mask sensitive data?
• A brokerage must retain trade confirmations in S3 for seven years, prevent deletion or overwrite even by admins, provide legal-hold capability, and prove integrity for regulators. Versioning alone failed audit. Which data-integrity mechanism enforces the retention requirement?
• A payment service stores 150 database and API credentials in AWS, requires automatic rotation every 30 days, must avoid code changes for new passwords, and needs audit trails for each retrieval. Which secrets design should the architect implement to manage rotation without application redeploys?
• A biotech firm hosts genomic APIs on private EC2 subnets that partner labs must reach without traversing the internet, with no inbound VPC changes per partner and private DNS for AWS services. Partners use separate AWS accounts and require scalable private connectivity. Which secure private access design meets these isolation needs?
• A regulated bank generates AES-256 keys in its on-premises HSM and requires that AWS never persist the plaintext key material, that the bank retains exclusive control of rotation, and that KMS-encrypted EBS volumes remain usable. Which key management design should the engineer select to manage imported and external key material?
• A regional bank stores loan records in S3 that must remain unchangeable for seven years, then move to cheaper storage and expire safely. Auditors require WORM enforcement plus automated transitions without custom code. Which lifecycle and retention design should the architect implement to satisfy immutable long-term record keeping?
• A genomics lab processes sensitive datasets on Amazon EMR with multi-node Spark clusters in a single VPC. Compliance mandates that all inter-node shuffle and HDFS replication traffic be encrypted in transit using certificates that EMR provisions to every node without custom code. Which control should the data engineer configure for inter-resource encryption in transit?
• A healthcare analytics team runs Amazon EKS with sensitive genomics traffic between pods across nodes and to RDS. Compliance requires encryption of all inter-node and pod-to-pod transit with mutual authentication, without managing certificates manually. Which inter-resource encryption design secures EKS transit traffic as required?
• A retailer encrypts S3 and EBS in us-east-1 and eu-west-1 with low-latency local decryption and centrally managed rotation, plus mutual TLS for internal services with private certificates. Which key and certificate management design should the security architect implement?
• A bank must encrypt Aurora data in us-east-1 and eu-west-1 under centralized control, allow independent regional decryption during an outage, and issue private mTLS certificates for microservices. Auditors require customer-managed key material. Which key and certificate plan should the security architect select to meet multi-Region resilience?
• A law firm stores case files on EFS and S3 and fears ransomware could encrypt primary data and backups together. Partners require immutable, cross-Region copies with tested restores and minimal RPO. Which backup and replication design should the engineer implement to ensure recoverable isolated copies?
• A payment processor must encrypt cardholder data in Aurora and S3 with distinct keys per environment, annual rotation, and immediate revocation on breach, while meeting PCI DSS key management evidence needs. Which data-at-rest encryption design satisfies these strict key lifecycle requirements?
• A regional bank runs a customer portal on an Application Load Balancer with EC2 targets. Auditors require TLS 1.2 or higher for all connections, HTTP must redirect to HTTPS, and weak ciphers must be disabled at the load balancer. Which ELB security policy control enforces encrypted-only access to the portal?
• A fintech runs a customer portal on EC2 behind an Application Load Balancer that currently accepts HTTP on port 80 and HTTPS with an old TLS policy. Auditors require encrypted client connections with TLS 1.2 or higher and no plain HTTP access. Which ELB security policy control enforces encryption for load balancer connections?
• A health analytics SaaS stores each clinic's reports in one S3 bucket with separate prefixes, must isolate encryption per tenant for offboarding, retain central KMS audit, and block unencrypted uploads. Which encryption-at-rest design meets all three tenant-isolation requirements?
• A regulated bank migrates HSM-backed keys to AWS KMS. Policy requires the bank to generate key bytes on-premises, control rotation timing, and prove deletion by expiring material, while another workload allows AWS to fully manage randomness and rotation. Which key-origin design correctly reflects the difference between imported and AWS-generated key material?
• A fintech startup stores 80 database passwords and third-party API keys in code and needs encrypted storage, distinct access control, and automatic 30-day rotation without code changes. Which secrets management design meets encrypted storage and automatic rotation requirements?
• A brokerage must keep trade confirmations in S3 immutable for seven years, allow no deletion even by admins, prove integrity to regulators, and keep prior versions if overwritten. Which data-integrity design guarantees provable immutability for compliance?
• A pharmaceutical company must retain clinical trial records in S3 for seven years, prevent deletion by any user including admins, detect accidental overwrites, and prove file authenticity for FDA audits. Which data-at-rest control set should the architect implement to guarantee record integrity?
• A fintech app writes account numbers to CloudWatch Logs and publishes order alerts via SNS that sometimes include emails. Compliance requires automatic redaction in logs and topics with audits of detected identifiers. Which masking control should the engineer implement to protect sensitive data in transit through logs and notifications?
• A healthcare startup hosts patient APIs on private subnets with no internet gateways, and partner clinics need secure private connectivity without traversing the public internet or managing VPNs. Traffic must stay on private networks with endpoint policies. Which private access design provides secure connectivity to the APIs?
• A bank runs payment APIs in a private VPC without internet egress and must let on-premises analysts query them over Direct Connect without exposing traffic to the public internet, using private DNS. The solution must avoid VPN operational overhead and scale automatically. Which secure private access design connects analysts to these VPC resources?
• A retail bank runs Amazon EMR with 20 worker nodes to score card transactions. Auditors require shuffle and RPC traffic between nodes to be TLS-encrypted, S3 spill data to use KMS, and settings to be reusable across clusters. Which inter-node encryption control provides compliant EMR transit protection?
• An insurance firm stores claims in S3 Standard, needs automatic transition to cheaper storage after 90 days, immutable retention for 3 years, and deletion after 7 years to limit liability. Which lifecycle design automates cost savings with compliant retention?
• A regional bank stores 40 TB of loan records in S3 Standard that auditors must be able to read but no one can delete for 7 years, and finance requires lower storage cost after 90 days without manual jobs. Versioning is enabled. Which S3 retention and lifecycle design meets the immutability and cost requirements?
• A pharmaceutical firm must generate AES-256 keys in its on-premises HSM for regulatory custody, use them in KMS for S3 encryption, rotate the material every year, and retain AWS audit trails of expiration. Which imported key material and rotation design satisfies the custody and rotation mandate?
• A healthcare SaaS encrypts PHI client-side with the AWS Encryption SDK using a KMS key in us-east-1 and stores the ciphertext in S3. It is expanding to eu-west-1 for disaster recovery, and replicated ciphertext must be decryptable in either Region without re-encrypting data or managing separate keys per Region. Which key strategy meets cross-Region decryptability with centralized control?
• A genomics firm runs Spark jobs on Amazon EMR handling PHI across three subnets, requiring that shuffle and node-to-node traffic remain encrypted without managing certificates on each host. Auditors require native inter-node encryption using KMS-backed keys. Which inter-resource encryption configuration meets the in-transit protection requirement?
• A healthcare startup stores patient records in S3 and RDS and must enforce distinct KMS keys per environment, automatic key rotation, and auditable decryption denials for HIPAA. Operations wants no application code changes for encryption handling. Which at-rest encryption design satisfies the regulatory isolation and auditability requirement?
• A 200-person SaaS firm keeps customer PostgreSQL on EC2 and file assets in S3, and after a ransomware scare must ensure encrypted cross-Region backups with air-gapped recovery, point-in-time restore, and tested restores without managing scripts. Which backup and replication design gives resilient ransomware protection?
• A genomics startup stores 20 TB of sequencing data in S3 and RDS snapshots, subject to HIPAA and customer-managed key rotation with per-project key isolation and audit of every decrypt call. The team wants envelope encryption without managing key storage. Which data-at-rest encryption design should the architect implement to meet isolation and auditability mandates?
• A startup security lead must explain to auditors why some KMS keys show automatic rotation while others need manual handling for an S3 archive. The archive uses customer-supplied key material from a partner HSM. Which distinction between AWS generated and imported key material is accurate for the audit?
• A payment app behind an Application Load Balancer must enforce encrypted browser connections using only strong TLS, automatically redirect HTTP to HTTPS, and pass audits proving weak ciphers are disabled. Users connect globally with modern browsers. Which load balancer control best enforces encrypted connectivity?
• A regional hospital runs encrypted EBS volumes and RDS databases supporting emergency care. Ransomware drills require immutable, cross-Region backups with air-gapped retention, lifecycle management, and quarterly restore testing without custom snapshot scripts. Which backup design provides secure replication and ransomware-resilient recovery?
• A regional bank stores signed loan agreements in S3 and must keep every final version immutable for seven years for regulators, while allowing deletion of incomplete uploads. Legal holds are applied during disputes. Which integrity control should the engineer configure to enforce immutable retention with version protection?
• A healthcare SaaS logs patient emails and national IDs to CloudWatch Logs and forwards alerts through SNS to an on-call topic, and compliance requires automatic masking in both places with an audit finding for each match. Which masking control satisfies both log and messaging requirements?
• A clinical trial firm stores signed consent PDFs in S3, must prove no file was altered for seven years, allow legal holds during disputes, and still permit new versions for corrections. Which integrity mechanism should the engineer configure to preserve evidentiary records while allowing corrections?
• A bank hosts a payments API on private ALBs in a service VPC and must let two partner VPCs call it without internet, public IPs, or transitive routing. Compliance requires private DNS names and a provider-controlled list of which partner accounts may connect. Which private connectivity control enables secure partner access to the API?
• A payments startup stores database passwords and third-party API keys in Lambda environment variables with manual rotation causing outages. They need automatic rotation, fine-grained audit, and no code changes for retrieval. Which secrets design should the team adopt to manage credential rotation securely?
• A SaaS startup stores database passwords and third-party API keys in environment variables, needs encrypted storage, automatic rotation every 30 days without code changes, and audit trails of retrieval. Developers share secrets manually. Which secrets management design enables encrypted storage with automatic rotation for the credentials?
• A payment processor must meet a regulator requiring payment keys be generated in its on-premises HSM, usable in AWS KMS for EBS and S3 encryption, automatically expiring yearly, with immediate revocation on demand. Cloud-only keys are rejected. Which imported key material design satisfies regulatory control and revocation?
• A genomics lab runs EMR on EC2 with Spark shuffling sensitive data between nodes across AZs and must encrypt all inter-node traffic with TLS using a reusable cluster-level setting, without hand-building a certificate authority (EMR release 7.11 or later). Which inter-resource encryption control secures EMR node traffic?
• A bank must issue private TLS certificates for internal services in eu-west-1 and us-east-1 from a bank-controlled private CA, with automatic certificate renewal and distinct trust per Region to limit blast radius. Which certificate authority design meets control, renewal, and isolation?
• A biotech firm keeps research data in S3 Standard for 90 days, then rarely accesses it for six years under a legal retention mandate that blocks deletion, while minimizing cost. Version churn is high. Which automatic lifecycle and retention solution should the engineer design to meet compliance and cost goals?
• A government contractor must use KMS keys with key material generated in its on-premises HSM, retain control over material lifetime, support manual rotation annually, and optionally enforce that AWS never stores material durably. Cloud-generated keys are prohibited. Which imported key material design meets the external control requirements for the workload?
• A gaming studio keeps player replays in S3 Standard, must move idle objects to cheaper tiers after 90 days, retain tournament highlights for three years immutably, and auto-delete drafts after one year. Which lifecycle and retention solution should the engineer design to optimize cost with compliant retention?