A company needs to protect data in transit between a web application and its users. Which AWS service can be used to manage SSL/TLS certificates for the application's domain?

AWS Identity and Access Management (IAM)

AWS Key Management Service (AWS KMS)

A company is deploying a new application that must comply with a requirement to encrypt all data at rest. Which AWS service is designed to centrally manage the customer master keys used for this encryption?

AWS Key Management Service (AWS KMS)

A company is deploying a new application on AWS that processes employee payroll data. The application runs on EC2 instances in a private subnet and needs to read records from an Amazon S3 bucket containing sensitive HR documents. The security team requires that the EC2 instances have no long-term credentials and that access to the S3 bucket is restricted to only the specific instances that need it. Which solution should the solutions architect implement?

Create a presigned URL for each S3 object and embed the URLs in the application code.

Create an IAM role with an S3 access policy, attach it to the EC2 instances, and use the role's temporary credentials in the application.

Create an IAM user with an access key and secret key, and store the credentials in the application's configuration file.

Create an S3 bucket policy that allows access to the bucket from the VPC's CIDR range, and configure the application to use anonymous access.

A company is required to encrypt all data at rest in Amazon S3. The security team wants to use envelope encryption and have the ability to rotate the data keys independently of the master key. They also need to ensure that the master key is stored in a managed service that supports automatic rotation. Which solution should the solutions architect implement?

Use AWS KMS with customer managed keys and enable automatic rotation of the KMS key.

Use client-side encryption with a master key stored in AWS Secrets Manager.

Use AWS CloudHSM to generate and store the master key, and implement custom envelope encryption in the application.

Use S3 server-side encryption with SSE-S3 and rely on AWS to rotate the keys.

AWSCertified Solutions Architect - Professional

Domain 2Objective 3

Task 2.3: Determine Security Controls Based on Requirements SAP-C02 Practice Questions (Page 2)

Part of the Content Domain 2: Design for New Solutions domain, which makes up ~31% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 4–6 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

10concepts

Questions 6–10

6foundation · easy
A company is developing an incident response plan. Which AWS service can be used to automate the execution of response actions, such as isolating an EC2 instance, in response to a security finding?
Select an answer first
7foundation · easy
A company needs to protect data in transit between a web application and its users. Which AWS service can be used to manage SSL/TLS certificates for the application's domain?
Select an answer first
8foundation · easy
A company is deploying a new application that must comply with a requirement to encrypt all data at rest. Which AWS service is designed to centrally manage the customer master keys used for this encryption?
Select an answer first
9application · medium
A company is deploying a new application on AWS that processes employee payroll data. The application runs on EC2 instances in a private subnet and needs to read records from an Amazon S3 bucket containing sensitive HR documents. The security team requires that the EC2 instances have no long-term credentials and that access to the S3 bucket is restricted to only the specific instances that need it. Which solution should the solutions architect implement?
Select an answer first
10expert · medium
A company is required to encrypt all data at rest in Amazon S3. The security team wants to use envelope encryption and have the ability to rotate the data keys independently of the master key. They also need to ensure that the master key is stored in a managed service that supports automatic rotation. Which solution should the solutions architect implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 2.3: Determine Security Controls Based on Requirements SAP-C02 Practice Questions (Page 2)

Questions 6–10

A company is developing an incident response plan. Which AWS service can be used to automate the execution of response actions, such as isolating an EC2 instance, in response to a security finding?

A company needs to protect data in transit between a web application and its users. Which AWS service can be used to manage SSL/TLS certificates for the application's domain?

A company is deploying a new application that must comply with a requirement to encrypt all data at rest. Which AWS service is designed to centrally manage the customer master keys used for this encryption?

Keep studying — Content Domain 2: Design for New Solutions