Task 3.2: Determine a Strategy to Improve Security. SAP-C02 Practice Questions (Page 7)

Questions 31–33

1. 31foundation · easy

   Which AWS service records API activity in an AWS account for auditing and security monitoring?

   • AAmazon CloudWatch
   • BAWS Config
   • CAWS Trusted Advisor
   • DAWS CloudTrail
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company hosts a web application on EC2 instances behind an Application Load Balancer. The application stores user data in an S3 bucket. A security review finds that the S3 bucket is publicly readable and that the EC2 instances have overly permissive security group rules. The company must align with a compliance standard that requires least-privilege access. Which set of actions should the company take?

   • AEnable S3 Block Public Access on the bucket, and open the security group to the company's office IP range.
   • BUse S3 bucket policies to restrict access to the EC2 instances' IAM roles, and leave the security group unchanged.
   • CRemove the public read permission from the bucket policy, and restrict the security group to allow traffic only from the load balancer.
   • DMove the S3 bucket to a different AWS account and use VPC endpoints for access.
   Reveal Solution Discussion Select an answer first
3. 33expert · hard

   A company is migrating a legacy application to AWS. The application currently runs on a single server with a local database. The security team wants to perform a security assessment of the proposed architecture. The architecture includes an Application Load Balancer, EC2 instances in an Auto Scaling group, and an RDS database. Which assessment activity is most important to perform first?

   • AReview the security group rules for the load balancer, EC2 instances, and RDS database.
   • BConduct a threat modeling exercise to identify potential attack vectors.
   • CIdentify the data classification and compliance requirements for the application's data.
   • DEnable CloudTrail and VPC Flow Logs to capture activity in the new environment.
   Reveal Solution Discussion Select an answer first