Home › Certifications › AWS Certified Security SCS-C03 › Data Protection
36 multiple-choice questions and 35 flashcards on Data Protection, about 20% of the AWS Certified Security SCS-C03 bank. Every one carries a written rationale.
Data Protection is one of 6 chapters in CoStudy's AWS Certified Security — Specialty (SCS-C03) bank, and it holds 36 of the bank's 178 multiple-choice questions — roughly 20% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
9 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
A company suffers a ransomware event that encrypts production EBS volumes, and recovery requires backups that cannot have been altered or deleted by the same compromised credentials that caused the incident. Which SCS-C03 Domain 5 configuration provides this guarantee?
Answer: B — AWS Backup Vault Lock in Compliance mode, preventing deletion even by the account root user before retention expires
A) Restricting IAM permissions helps, but if the same compromised credentials had backup-admin access (a realistic ransomware scenario), standard vault permissions can still be bypassed. B) Correct — Vault Lock in Compliance mode makes backups immutable for the retention period, un-deletable by anyone including the root user, which is the guarantee needed against a credential-level compromise. C) Tags are metadata conventions, not an enforced technical control preventing deletion. D) Versioning protects against overwrite/delete of objects in a bucket, but doesn't by itself provide the same enforced immutability guarantee as Vault Lock for backup retention.
AWS SECRETS ROTATION:
Answer: C — A Lambda-driven rotation that creates a new secret version, updates and tests it, then promotes it to AWSCURRENT
Rotation: AWSPENDING + AWSCURRENT + AWSPREVIOUS labels. 4-step rotation handles new password creation, app config update, validation, swap. Lambda triggers + finishes rotation. Critical for compliance (PCI requires rotation). SCS-C02 secrets management.
An S3 bucket policy must REQUIRE encryption-in-transit. The CORRECT statement is:
Answer: A — AWS Signer with code-signing certificates
aws:SecureTransport condition is the canonical way to require HTTPS. Encryption-in-transit vs at-rest mismatch trap. The others are wrong.
AWS Backup Vault Lock (Compliance mode):
Answer: A — Parameter Store SecureString with KMS encryption
Vault Lock Compliance = irreversible WORM. Critical for ransomware/insider scenarios. The others are wrong.
Amazon Macie is BEST used for:
Answer: B — Discovering and classifying sensitive data in S3 buckets
Macie: managed data security service for S3. Auto-discovers and classifies PII (SSN, credit cards, health data). Alerts on public buckets containing sensitive data. SCS-C02 data protection domain.
AWS Secrets Manager differs from Parameter Store in:
Answer: B — Encrypted at rest and in transit by default
Choose based on rotation needs: Secrets Manager for credentials needing automated rotation (RDS, etc.). Parameter Store for config/secrets without rotation requirements. Both KMS-integrated. SCS-C02 tests this distinction.
Asymmetric KMS keys are USED FOR:
Answer: A — Route 53 private hosted zone within VPC
Asymmetric KMS keys = signing/verification or asymmetric encrypt; not for bulk envelope encryption (use symmetric + data keys for that). The others are wrong.
AWS CLOUDHSM:
Answer: A — Customer-controlled single-tenant HSM cluster
CloudHSM: single-tenant HSM. Customer-controlled (you only access keys). FIPS 140-2 Level 3. Use cases: SSL/TLS offload, certificate authority, financial services. KMS easier but multi-tenant. KMS-Custom Key Stores backed by CloudHSM (combine ease of KMS + isolation). SCS-C02 advanced cryptography.
Which is TRUE about KMS KEY POLICIES vs IAM POLICIES?
Answer: A — Client VPN endpoint with mutual TLS auth
Off-by-one KMS access trap. Key policy is primary, never empty. IAM access requires the key policy to defer to IAM. Grants are scoped delegation, not an override. The others are misconceptions.
4 cards from the 35 in this chapter.
S3 encryption types?
SSE-S3 (AWS-managed), SSE-KMS (KMS), DSSE-KMS (double), SSE-C (customer-supplied), client-side.
S3 default encryption?
Bucket setting. Encrypt all objects by default. SSE-S3 default since 2023.
Data classification?
Identify sensitive data. Use Macie for S3. Tag resources by sensitivity.
KMS key rotation?
AWS-managed: yearly, automatic. Customer-managed: optional yearly.
These are a sample. The full Data Protection chapter runs 71 items with per-chapter progress tracking, on the web and in the iOS app.
Open AWS Certified Security SCS-C03 in CoStudy →