Task 2.3: Determine Security Controls Based on Requirements SAP-C02 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   During an incident, a security analyst needs to collect forensic evidence from an EC2 instance without disrupting the running system. Which AWS service can be used to create a point-in-time snapshot of the instance's EBS volumes for analysis?

   • AAWS CloudTrail
   • BAWS Backup
   • CAmazon Elastic Block Store (EBS)
   • DAmazon S3
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A company has a critical application running on AWS. The security team has developed an incident response plan that includes isolating compromised EC2 instances and preserving evidence. The plan must be automated to minimize response time. Which solution should the solutions architect implement?

   • AUse Amazon CloudWatch Events to send a notification to the security team when an incident is detected.
   • BUse AWS Systems Manager Automation to create a runbook that detaches the instance's security group and takes an EBS snapshot.
   • CUse AWS Config to automatically change the security group of the instance.
   • DUse AWS Lambda to terminate the compromised instance immediately.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A company wants to protect data as it travels between an on-premises data center and AWS over the internet. Which AWS service provides a private, encrypted connection between the on-premises network and a VPC?

   • AAWS Transit Gateway
   • BAWS Site-to-Site VPN
   • CAmazon CloudFront
   • DAWS Direct Connect
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   A company is deploying a new application that uses Amazon API Gateway and AWS Lambda. The security team requires that the API be accessible only from the company's VPC and that the Lambda function be able to access resources in the VPC. Which solution should the solutions architect implement?

   • APlace the Lambda function in a public subnet and use a security group to restrict access.
   • BUse an IAM policy to restrict API Gateway access to only the company's VPC CIDR.
   • CCreate a VPC endpoint for API Gateway and configure the API to be private, and configure the Lambda function to access the VPC.
   • DUse AWS WAF to allow traffic only from the company's VPC.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services company is building a multi-tier web application on AWS. The web tier must be publicly accessible, while the application tier must only be reachable from the web tier. The database tier must be isolated from both tiers and only accessible from the application tier. The company requires that all traffic between tiers be encrypted. Which combination of actions should a solutions architect take?

   • APlace each tier in a separate subnet, use security groups to control traffic between tiers, and enable encryption in transit for all inter-tier communication.
   • BUse a single security group for all instances and rely on IAM policies to restrict access.
   • CPlace all tiers in the same subnet and use network ACLs to restrict traffic between instances.
   • DPlace the web tier in a public subnet, the application tier in a private subnet, and the database tier in a separate private subnet, but do not encrypt traffic between tiers.
   Reveal Solution Discussion Select an answer first