Task 3.2: Determine a Strategy to Improve Security. SAP-C02 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company runs a legacy web application on EC2 instances in a public subnet. A security assessment reveals that the application stores sensitive customer data in an unencrypted MySQL database on the same instance. The company must improve security without changing the application code. Which combination of actions should the company take?

   • AEnable AWS Config managed rules for encrypted volumes and EC2 instances in public subnets.
   • BPlace the EC2 instance in a private subnet and use a NAT gateway for outbound internet access.
   • CMove the database to an RDS instance with encryption enabled, and restrict security group access to the application instance.
   • DEnable encryption on the existing EC2 instance's root volume and attach a new encrypted EBS volume for the database.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is preparing for a PCI DSS audit. The security team has identified that the company's VPC has a default security group that allows all traffic, and that the RDS database is publicly accessible. The team must remediate these issues before the audit. Which solution should the team implement?

   • AEnable AWS Config rules to detect public RDS instances and non-compliant security groups.
   • BCreate a new security group that allows traffic only from the application, and attach it to the RDS database.
   • CModify the default security group to deny all traffic, and move the RDS database to a private subnet.
   • DUse AWS Network Firewall to block traffic to the RDS database from the internet.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company's threat modeling exercise identifies that an attacker who compromises an application container could pivot to the underlying host and then to other containers. The environment uses Amazon ECS on EC2 with a single cluster. The security team wants to reduce the blast radius of a container breakout. Which strategy is most effective?

   • ARun each container as a separate ECS task on dedicated EC2 instances, and use security groups to restrict traffic between tasks.
   • BEnable ECS managed container insights and use CloudWatch alarms to detect unusual activity.
   • CUse a single ECS task with multiple containers, and rely on the default Docker bridge network to isolate them.
   • DApply a restrictive IAM role to the ECS task and use resource-based policies on all AWS services.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A company wants to be prepared to handle a security breach effectively. What should the company develop?

   • ACompliance checklist
   • BThreat model
   • CIncident response plan
   • DSecurity assessment
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's security team conducts an annual security review of its AWS environment. The review finds that several IAM roles have excessive permissions and that CloudTrail is not enabled in all regions. The team wants to establish a continuous improvement process to address these issues. Which solution should the team implement?

   • AUse AWS Organizations to enforce service control policies that restrict IAM permissions and enable CloudTrail organization-wide.
   • BEnable AWS Config with managed rules for IAM role permissions and CloudTrail, and use remediation actions to automatically fix non-compliant resources.
   • CSchedule a monthly manual review of IAM roles and CloudTrail logs using a shared spreadsheet.
   • DEnable AWS Trusted Advisor to check for IAM role issues and CloudTrail configuration, and review the report quarterly.
   Reveal Solution Discussion Select an answer first