Task 3.2: Determine a Strategy to Improve Security. SAP-C02 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A solutions architect is analyzing an application to identify potential attack vectors and prioritize security improvements. Which practice is the architect applying?

   • ACompliance alignment
   • BThreat modeling
   • CSecurity monitoring
   • DSecurity assessment
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which AWS service is used to control access to AWS resources by defining permissions for users and roles?

   • AAWS CloudTrail
   • BAWS Identity and Access Management (IAM)
   • CAWS Key Management Service (KMS)
   • DAWS Config
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company has a fleet of EC2 instances that run a batch processing job. The security team discovers that the instances have SSH access open to the internet (0.0.0.0/0). The team wants to restrict SSH access to only the company's office IP range while maintaining the ability to manage the instances. Which solution should the team implement?

   • APlace the instances in a private subnet and use a bastion host for SSH access.
   • BUse AWS Systems Manager Session Manager to access the instances, and remove the SSH security group rule.
   • CModify the security group to allow SSH only from the company's office IP range.
   • DEnable AWS Shield Advanced to protect the instances from DDoS attacks.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company operates in the European Union and must comply with GDPR. The company stores personal data in an S3 bucket in the eu-west-1 region. The security team wants to ensure that only authorized users can access the data and that access is logged. Which solution should the team implement?

   • AEnable S3 Block Public Access and use AWS Organizations to restrict access to the bucket.
   • BMove the data to an EBS volume and use a VPN for access.
   • CUse AWS KMS to encrypt the bucket and enable CloudTrail for S3 management events.
   • DUse S3 bucket policies to restrict access to specific IAM roles, and enable S3 server access logging.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is required to encrypt all data at rest in its AWS environment. The company uses S3, EBS, RDS, and DynamoDB. The security team wants to implement a centralized solution to enforce encryption across all services. Which solution should the team implement?

   • AUse AWS Secrets Manager to store encryption keys for each service.
   • BEnable AWS Config rules to detect unencrypted resources and send alerts.
   • CUse AWS KMS with customer-managed keys and enable encryption on each service individually.
   • DUse AWS Certificate Manager to issue SSL/TLS certificates for all services.
   Reveal Solution Discussion Select an answer first