Task 3.2: Determine a Strategy to Improve Security. SAP-C02 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the key characteristic of continuous security improvement?

   • AIt is only for new solutions
   • BIt is a one-time assessment
   • CIt focuses only on compliance
   • DIt involves regular reviews and updates
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which AWS service can be used to track resource configurations and evaluate them against compliance rules?

   • AAWS Shield
   • BAmazon GuardDuty
   • CAWS Config
   • DAWS WAF
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company uses AWS Systems Manager Patch Manager to patch EC2 instances, but the security team wants to ensure that all instances are patched within 7 days of a new patch release. The company has a maintenance window of 2 hours every Sunday. Which solution should the company implement?

   • ACreate a Systems Manager maintenance window that runs a patch baseline on a weekly schedule, and assign all instances to it.
   • BUse AWS OpsWorks to manage patches and configure it to run on a daily basis.
   • CUse AWS Config rules to detect instances that are missing patches and send an alert to the security team.
   • DEnable Systems Manager Patch Manager to automatically apply patches as soon as they are released.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of an incident response plan?

   • ATo provide a structured approach to handle security incidents
   • BTo automate security patching
   • CTo identify potential threats
   • DTo evaluate compliance
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company processes healthcare data in AWS and must comply with HIPAA. The company uses S3 for storage and EC2 for processing. A security assessment reveals that S3 buckets are not configured with default encryption and that access logs are not enabled. The company wants to remediate these findings while minimizing operational overhead. Which solution should the company implement?

   • AEnable S3 default encryption on all buckets, and enable S3 server access logging to a centralized logging bucket.
   • BUse AWS KMS with customer-managed keys for all S3 buckets, and enable CloudTrail for S3 data events.
   • CMove all data to EBS volumes with encryption enabled, and use VPC Flow Logs for network monitoring.
   • DEnable S3 Object Lock on all buckets, and use AWS Config rules to detect unencrypted buckets.
   Reveal Solution Discussion Select an answer first