Data Protection: 5 SCS-C03 Questions with Full Explanations
Data Protection is a recurring theme in the AWS Security – Specialty (SCS-C03) exam. It makes up about 18% of the exam. The 5 questions below come with a full explanation of why each option is right or wrong.
AWS Security – Specialty (SCS-C03) · Data Protection · 5 questions with answers and explanations
🧭 Before you start
Data protection questions first classify the data: moving over a network, stored at rest, or a secret or key in its own right. The scenario then adds a pressure (certificate renewal, KMS request cost, PII spread across many buckets, rotation without downtime, a second Region) and asks which feature handles it natively. Distractors often change how data is accessed instead of how it is protected.
Keep in mind
• Ask who issued a certificate before assuming it renews itself. Certificates brought into ACM from outside follow a different lifecycle from those ACM issues.
• High KMS request volume from SSE-KMS has an S3-side fix that reduces calls to KMS; features that change how objects are read or filtered do not help.
• For decryption in a second Region, ask whether the same key material exists there. For rotation without downtime, consider how old credentials stay valid during the switch.
Question 1 of 5
Users report intermittent TLS handshake failures when connecting to an application behind a Network Load Balancer configured with a TLS listener. Investigation shows the ACM certificate attached to the listener expired two days ago and was not renewed. What is the most likely reason automatic renewal did not occur?
Show answer
✅ Answer: C
Difficulty: advanced · Topic: ACM, Elastic Load Balancing (NLB)
Which ACM certificates renew automatically
ACM manages renewal for certificates it issues:
• Public ACM certificates renew automatically when they are in use (associated with a service such as ELB or CloudFront) and domain validation still succeeds, for example the DNS validation CNAME is still in place.
• Private certificates issued through ACM from AWS Private CA also renew automatically.
Imported certificates are different. You bring a certificate and key from another CA; ACM stores them and lets you attach them to integrated services, but it cannot ask your CA for a new certificate. You must obtain a new certificate and reimport it (reimporting into the same ARN updates every attached listener).
ACM sends expiration events to Amazon EventBridge and AWS Health beforehand, which you can use to alert on upcoming expiry.
Why each option works or fails
• ✗ A. NLB listeners not eligible: NLB TLS listeners are an ACM-integrated service; ACM-issued certificates attached to them renew like any other.
• ✗ B. CloudFront only: managed renewal applies to ACM-issued certificates on every integrated service, including ALB, NLB and API Gateway, not only CloudFront.
• ✓ C. Imported certificate (correct): ACM never renews imported certificates, so when it expired the NLB kept presenting it and clients failed the handshake.
• ✗ D. Renewal quota exceeded: there is no monthly renewal quota that silently skips renewals; ACM quotas limit how many certificates you request or import.
Question 2 of 5
High-volume S3 uploads with SSE-KMS incur large KMS request costs. Which feature reduces them?
Show answer
✅ Answer: A
Difficulty: advanced · Topic: Amazon S3, AWS KMS
Why SSE-KMS gets expensive and how Bucket Keys help
With SSE-KMS, S3 normally asks AWS KMS for a new data key for each object it encrypts (GenerateDataKey) and calls Decrypt on reads. Every call is a billable KMS request and counts toward KMS request quotas, so millions of uploads mean millions of KMS calls.
S3 Bucket Keys change this:
• S3 obtains a short-lived bucket-level key from KMS and uses it inside S3 to create unique data keys for many objects.
• KMS is called only when that bucket-level key is refreshed, which can cut KMS request traffic by up to 99%.
• Objects stay encrypted under your KMS key, so key policies and audit still apply; CloudTrail shows the bucket ARN rather than each object ARN in the encryption context.
Example
Enable Bucket Key in the bucket's default encryption settings (BucketKeyEnabled: true). New uploads use it; existing objects pick it up only when copied or re-encrypted. Policies that check kms:EncryptionContext for object ARNs must be updated to the bucket ARN.
Why each option works or fails
• ✓ A. S3 Bucket Keys (correct): a bucket-level key generates per-object data keys inside S3, so far fewer KMS requests are made while the data stays protected by the same KMS key.
• ✗ B. S3 Object Lambda: it runs Lambda code to transform objects as they are retrieved; it adds processing on reads and does nothing to reduce KMS calls on uploads.
• ✗ C. S3 Access Points: they give named endpoints with their own access policies for shared datasets; each request through them still uses KMS the same way.
• ✗ D. S3 Select: it filters rows inside an object on read to return less data (and is no longer offered to new customers); it does not change how objects are encrypted on upload.
Question 3 of 5
The governance team must know which of 1,200 buckets across the org contain PII, updated continuously, at controlled cost, with findings routed to Security Hub. Which approach fits?
Show answer
✅ Answer: B
Difficulty: advanced · Topic: Amazon Macie, AWS Security Hub
Two ways Macie finds sensitive data
Amazon Macie inspects S3 object contents for sensitive data such as names, addresses or credit card numbers.
• Sensitive data discovery jobs: you choose buckets and objects to fully analyze, once or on a schedule. Thorough, but cost grows with the amount of data scanned.
• Automated sensitive data discovery: Macie continuously selects representative samples of objects across all buckets, builds a sensitivity score per bucket, and shows which ones likely contain PII. Sampling keeps cost controlled at large scale.
In an organization, a Macie delegated administrator account enables Macie and automated discovery for all members. Macie can publish its findings to AWS Security Hub, where they join other security findings.
Why each option works or fails
• ✗ A. GuardDuty S3 Protection: it analyzes S3 data events for suspicious access patterns; it does not look at object contents or identify PII.
• ✓ B. Automated discovery via delegated admin with Security Hub (correct): sampling gives continuous, cost-controlled coverage of all 1,200 buckets, and findings flow centrally into Security Hub.
• ✗ C. S3 Inventory: it lists objects and metadata such as size and encryption status; it does not inspect contents for sensitive data.
• ✗ D. Daily full classification jobs: scanning every object every day across 1,200 buckets is very costly and repeats work, conflicting with the cost requirement.
Question 4 of 5
Database credentials must be rotated automatically without application downtime. Which approach fits?
Show answer
✅ Answer: B
Difficulty: applied · Topic: AWS Secrets Manager
Rotation strategies in Secrets Manager
AWS Secrets Manager rotates database credentials with a rotation function (managed rotation for supported databases, or a Lambda function). There are two strategies:
• Single user: the password of one user is changed in place. Connections opening during the change can briefly fail.
• Alternating users: Secrets Manager keeps two users (for example app_user and app_user_clone). Each rotation updates the user that is not currently active, then switches the secret to it. The previous credentials stay valid until the next rotation, so applications that read the secret keep working.
Alternating users needs a separate superuser secret that can change the other user's password.
Example: rotation every 30 days; applications call GetSecretValue (with caching) and always get a working username and password.
Why each option works or fails
• ✗ A. Environment variables: they are static configuration; nothing rotates them, and a change needs redeployment or restart.
• ✓ B. Alternating users rotation (correct): one valid credential set is always available while the other is being changed, so rotation happens automatically with no downtime.
• ✗ C. Manual changes and restarts: manual rotation is error-prone and the restart itself is the downtime the requirement forbids.
• ✗ D. Hard-coded password: changing it requires a code change and deployment, so automatic rotation is impossible and the password is exposed in source.
Question 5 of 5
Encrypted data is replicated from us-east-1 to us-west-2 for disaster recovery. The team wants to decrypt the replicated data in us-west-2 without cross-Region KMS calls and without re-encrypting it. Which approach fits BEST?
Show answer
✅ Answer: B
Difficulty: advanced · Topic: AWS KMS
KMS keys are Regional
A KMS key normally exists in one Region, and ciphertext can only be decrypted by the same key. Data replicated to us-west-2 would still need a call back to us-east-1 to decrypt, or it would have to be re-encrypted under a local key.
Multi-Region keys
A multi-Region key is a set of related keys in different Regions that share the same key ID and key material.
• The primary key (for example mrk-1234abcd... in us-east-1) is replicated to a replica key in us-west-2.
• Ciphertext produced by the primary can be decrypted by the replica locally, with no cross-Region call.
• Each replica has its own key policy, grants and aliases, and key material rotation is shared across the set.
Example
An application encrypts records with the primary in us-east-1. During a DR failover, the us-west-2 copy of the application calls Decrypt on the replica and reads the same records.
Why each option works or fails
• ✗ A. Export key material: KMS never exports key material it generates, and even keys with identical imported material cannot decrypt each other's ciphertext because ciphertext is bound to the specific key.
• ✓ B. Multi-Region key with a replica (correct): related keys share key material, so data encrypted in us-east-1 decrypts in us-west-2 with a local call and no re-encryption.
• ✗ C. Same alias in each Region: an alias is just a Region-local name; two single-Region keys still have different key material, so neither can decrypt the other's ciphertext.
• ✗ D. SSE-S3: switching means re-encrypting the existing data, which the team wants to avoid, and it gives up KMS key policies and per-request KMS audit in CloudTrail.
🎯 Quick recap
• ACM renews what it issues; imported certificates must be renewed and reimported by you, so monitor their expiry.
• High KMS request costs from SSE-KMS are cut with S3 Bucket Keys; access points, Object Lambda and Select change how data is accessed, not how often KMS is called.
• Continuous, cost-controlled PII visibility across many buckets is Macie automated discovery, not repeated full scans or non-content tools.
• Zero-downtime automatic credential rotation is Secrets Manager with the alternating users strategy, which keeps the old credentials valid during the switch.
• To decrypt the same ciphertext in another Region without re-encrypting, use a KMS multi-Region key and its replica.
📊 About this set
Exam: SCS-C03 · 65 questions · 170 minutes · passing score 750
This set: 4 advanced, 1 applied · 3 scenario, 1 concept check, 1 troubleshooting
Topics: ACM, Elastic Load Balancing (NLB), Amazon S3, AWS KMS, Amazon Macie, AWS Security Hub, AWS Secrets Manager
🔗 Related practice sets
• SCS-C03 Practice Set: Incident Response
• Infrastructure Security: 5 SCS-C03 Questions with Full Explanations
• AWS Security – Specialty (SCS-C03): 5 Practice Questions on Identity and Access Management
• All SCS-C03 practice sets
• Every exam on this blog
📚 More SCS-C03 practice
More SCS-C03 questions: https://hyunhp.github.io/cert-bank/#exam=SCS-C03
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=SCS-C03
These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.
Original practice questions written for this blog, not exam dumps.
Comments
Post a Comment