Data Protection
Free AWS Certified Security – Specialty (SCS-C03) practice — 6 questions on Data Protection, with explanations. No sign-up. Full 12-question mixed test →
A financial services company stores customer transaction data in Amazon S3. They must comply with PCI DSS requirements mandating that encryption keys are rotated every 90 days and that the company maintains full control over key material generation and rotation. The solution must provide detailed audit trails of all key usage. Which approach meets these requirements with the LEAST operational overhead?
CloudHSM provides full control over key material generation within a FIPS 140-2 Level 3 validated HSM that the customer exclusively controls. Custom rotation logic via Lambda allows precise 90-day rotation scheduling. CloudHSM audit logs provide detailed cryptographic operation trails required for PCI DSS compliance. This is the only option meeting the 'full control over key material generation' requirement.
A healthcare application processes Protected Health Information (PHI) using Amazon EMR clusters. The data engineering team needs to ensure that data at rest on EMR cluster nodes is encrypted, data in transit between nodes is encrypted, and encryption keys are rotated quarterly. The security team requires that decryption of data should be impossible if an EBS volume is detached and attached to another instance. Which configuration satisfies all requirements?
EMR security configuration with EBS encryption using customer managed KMS keys ensures volume-level encryption bound to KMS permissions. When a volume is detached, it cannot be decrypted on another instance without proper KMS key access policies. In-transit encryption protects node-to-node communication. KMS automatic rotation creates new cryptographic material annually (NOTE: while the requirement states quarterly, KMS automatic rotation is annual; however, this is still the best available option as manual rotation would add overhead, and this is the closest match). The encrypted snapshot option ensures volumes remain encrypted throughout their lifecycle.
A company uses AWS Certificate Manager (ACM) to manage SSL/TLS certificates for their Application Load Balancers. They need to implement a solution where certificates for on-premises servers are generated using the same private certificate authority (CA) to maintain a unified PKI infrastructure. The private CA must have intermediate CA certificates that chain to a root CA managed by the company's security team in an isolated AWS account. Which solution meets these requirements?
This creates a proper CA hierarchy: root CA in isolated security account (best practice for root CA protection), subordinate CA in application account for operational certificate issuance. The CSR signing process establishes the trust chain. ACM Private CA subordinate can issue certificates both for ACM (ALBs) and export certificates for on-premises servers via GetCertificate API, meeting the unified PKI requirement.
A data analytics team processes sensitive customer data using AWS Glue ETL jobs that read from Amazon S3, transform data, and write to Amazon Redshift. The security team mandates that Glue must not have persistent access to decrypt S3 data - decryption permissions should only be available during active job execution. Additionally, all encryption keys must be different for S3, Redshift, and Glue's own metadata. Which configuration meets these requirements?
The kms:ViaService condition ensures the Glue role can only decrypt S3 data when the request comes through S3 service itself (during active job execution reading from S3), not through direct KMS API calls. This effectively limits decryption to job runtime without requiring dynamic permission changes. The aws:PrincipalArn condition restricts which role can use this permission. Separate keys for each service meet the distinct key requirement. This is a KMS key policy pattern specifically designed for this use case.
A company stores application logs in Amazon S3 with a lifecycle policy that transitions objects to S3 Glacier Flexible Retrieval after 90 days and to Glacier Deep Archive after 1 year. The compliance team requires that all log data, regardless of storage class, must be encrypted with keys that can be immediately disabled in case of a security incident, and that any key disablement must prevent ALL future access to the data even if objects are restored from Glacier. The current encryption uses SSE-KMS with a customer managed key. What additional configuration is required to meet the immediate disable requirement?
KMS keys with imported key material allow deletion of the cryptographic material itself while keeping the key ID and metadata. When you delete imported key material, the key becomes immediately unusable for all cryptographic operations including decryption, affecting all objects encrypted with that key regardless of their S3 storage class. Objects cannot be decrypted even after Glacier restore. The key material can be deleted immediately without waiting for the standard 7-30 day KMS key deletion waiting period. This meets the 'immediate disable' and 'prevent ALL future access' requirements perfectly.
A company uses Amazon Macie to discover and classify sensitive data in S3 buckets. They have configured custom data identifiers to detect proprietary product codes with the pattern 'PROD-[A-Z]{3}-[0-9]{4}'. Security findings show that Macie is generating false positives by matching test data files that contain similar patterns but with an additional '-TEST' suffix (e.g., 'PROD-ABC-1234-TEST'). The company needs to reduce false positives while ensuring actual product codes are still detected. Data is stored in both CSV and JSON formats. What is the MOST effective solution?
Negative lookahead regex pattern (?!-TEST) ensures the pattern matches 'PROD-ABC-1234' but not 'PROD-ABC-1234-TEST', directly addressing the false positive source. This is processed during pattern matching, making it efficient and precise. The maximum match distance setting helps prevent matches that span across unrelated data fields in structured formats like CSV/JSON. This is the most targeted solution that modifies the detection logic itself rather than working around it.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$119.99 $34.99 with code FREETEST33 — valid through August 23.
Get my $34.99 deal →