A solutions architect needs to protect data at rest in an Amazon S3 bucket. Which control should be applied?

Enable server-side encryption on the bucket

A company runs a public-facing web application on EC2 instances behind an Application Load Balancer. The application uses a MySQL database on RDS. A threat model identifies the risk of SQL injection and data exfiltration. Which control should the company implement to mitigate the risk of SQL injection?

Restrict the RDS security group to allow traffic only from the EC2 instances.

Enable encryption on the RDS database and use SSL for connections.

Use AWS WAF to add a rule that blocks SQL injection attacks.

Enable CloudTrail for RDS and monitor for suspicious queries.

A company must ensure its AWS environment meets the requirements of a specific industry regulation. Which activity is the company performing?

Compliance and regulatory alignment

A company's incident response plan requires that when a security finding is detected, the affected EC2 instance is immediately isolated from the network. The company uses AWS GuardDuty for threat detection. Which solution should the company implement to automate this response?

Create an Amazon EventBridge rule that triggers an AWS Lambda function to change the security group of the affected instance.

Configure GuardDuty to automatically terminate the instance when a finding is detected.

Use AWS Systems Manager Automation to run a runbook that stops the instance.

Use AWS Config to detect the finding and apply a remediation action to detach the instance from the VPC.

AWSCertified Solutions Architect - Professional

Domain 3Objective 2

Task 3.2: Determine a Strategy to Improve Security. SAP-C02 Practice Questions (Page 6)

Part of the Content Domain 3: Continuous Improvement for Existing Solutions domain, which makes up ~27% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

Questions 26–30

26foundation · easy
Which AWS service can be used to automate compliance checks on AWS resources?
Select an answer first
27foundation · easy
A solutions architect needs to protect data at rest in an Amazon S3 bucket. Which control should be applied?
Select an answer first
28application · medium
A company runs a public-facing web application on EC2 instances behind an Application Load Balancer. The application uses a MySQL database on RDS. A threat model identifies the risk of SQL injection and data exfiltration. Which control should the company implement to mitigate the risk of SQL injection?
Select an answer first
29foundation · easy
A company must ensure its AWS environment meets the requirements of a specific industry regulation. Which activity is the company performing?
Select an answer first
30application · medium
A company's incident response plan requires that when a security finding is detected, the affected EC2 instance is immediately isolated from the network. The company uses AWS GuardDuty for threat detection. Which solution should the company implement to automate this response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 3.2: Determine a Strategy to Improve Security. SAP-C02 Practice Questions (Page 6)

Questions 26–30

Which AWS service can be used to automate compliance checks on AWS resources?

A solutions architect needs to protect data at rest in an Amazon S3 bucket. Which control should be applied?

A company must ensure its AWS environment meets the requirements of a specific industry regulation. Which activity is the company performing?

A company's incident response plan requires that when a security finding is detected, the affected EC2 instance is immediately isolated from the network. The company uses AWS GuardDuty for threat detection. Which solution should the company implement to automate this response?

Keep studying — Content Domain 3: Continuous Improvement for Existing Solutions