A company uses AWS Organizations and has multiple accounts. The security team wants to enforce a policy that requires all S3 buckets to have encryption enabled and to automatically remediate any non-compliant buckets. The team wants to minimize the number of resources to manage. Which solution should the team implement?

Use AWS CloudFormation StackSets to deploy a bucket with encryption enabled in each account.

Use AWS Config with a managed rule and remediation action in each account, and aggregate findings in the management account.

Use AWS Security Hub to detect unencrypted buckets and send an alert to the security team.

Use AWS Organizations service control policies to deny the creation of unencrypted S3 buckets.

What is the main goal of threat modeling?

To automate security compliance checks

To monitor logs for security incidents

To identify and prioritize potential threats and attack vectors

A company has an incident response plan that relies on manual steps to isolate compromised EC2 instances. The plan requires a security engineer to identify the instance, create a new security group, and then attach it. The company wants to reduce the time to containment. Which solution should the company implement?

Use AWS Systems Manager Automation to run a pre-defined runbook that isolates the instance by changing its security group.

Create an AWS Lambda function that is manually triggered by the security engineer to detach the instance from the VPC.

Enable AWS GuardDuty and configure it to automatically terminate compromised instances.

Use AWS Config rules to automatically remediate non-compliant instances by applying a restrictive security group.

A company wants to automatically apply security patches to its EC2 instances on a regular schedule. Which approach should be used?

Use AWS Systems Manager Patch Manager

AWSCertified Solutions Architect - Professional

Domain 3Objective 2

Task 3.2: Determine a Strategy to Improve Security. SAP-C02 Practice Questions (Page 1)

Part of the Content Domain 3: Continuous Improvement for Existing Solutions domain, which makes up ~27% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

Questions 1–5

1expert · hard
A company uses AWS Organizations and has multiple accounts. The security team wants to enforce a policy that requires all S3 buckets to have encryption enabled and to automatically remediate any non-compliant buckets. The team wants to minimize the number of resources to manage. Which solution should the team implement?
Select an answer first
2foundation · easy
What is the main goal of threat modeling?
Select an answer first
3expert · hard
A company has an incident response plan that relies on manual steps to isolate compromised EC2 instances. The plan requires a security engineer to identify the instance, create a new security group, and then attach it. The company wants to reduce the time to containment. Which solution should the company implement?
Select an answer first
4foundation · easy
A solutions architect is reviewing an existing application to identify security gaps and risks. Which activity is the architect performing?
Select an answer first
5foundation · easy
A company wants to automatically apply security patches to its EC2 instances on a regular schedule. Which approach should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 3.2: Determine a Strategy to Improve Security. SAP-C02 Practice Questions (Page 1)

Questions 1–5

What is the main goal of threat modeling?

A solutions architect is reviewing an existing application to identify security gaps and risks. Which activity is the architect performing?

A company wants to automatically apply security patches to its EC2 instances on a regular schedule. Which approach should be used?

Keep studying — Content Domain 3: Continuous Improvement for Existing Solutions