Task 2.3: Determine Security Controls Based on Requirements SAP-C02 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is deploying a new application on AWS and needs to detect and respond to security events. The security team wants to centralize logs from multiple AWS services, including CloudTrail, VPC Flow Logs, and application logs. They also need to create alerts for specific patterns, such as multiple failed login attempts. Which solution should the solutions architect implement?

   • AEnable VPC Flow Logs and CloudTrail, but store logs only in the respective services without centralization.
   • BSend all logs to Amazon CloudWatch Logs and use CloudWatch Logs Insights to query and create metric filters for alerts.
   • CStore logs in Amazon S3 and use Amazon Athena to query them, but do not set up any alerting.
   • DUse AWS Config to collect logs and send alerts via Amazon Simple Notification Service (Amazon SNS).
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is designing a new web application that will be publicly accessible. The security team is performing a threat model and identifies that the application could be vulnerable to SQL injection attacks. Which security control should the solutions architect implement to mitigate this threat?

   • AUse security groups to restrict access to the database to only the application servers.
   • BEnable encryption in transit using TLS for all client connections.
   • CUse an AWS WAF rule to block SQL injection patterns in incoming requests.
   • DEnable VPC Flow Logs to monitor traffic to the database.
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A company is deploying a multi-tier application on AWS. The web tier is in a public subnet, and the application tier is in a private subnet. The security team has identified that the application tier should not be directly accessible from the internet. However, the application tier needs to make outbound calls to a third-party API over HTTPS. The company also wants to ensure that if the web tier is compromised, the attacker cannot use it to access the application tier. Which solution should the solutions architect implement?

   • AUse a security group on the application tier that allows inbound traffic only from the web tier's security group, and allow outbound HTTPS traffic to the internet.
   • BPlace the application tier in a public subnet and use a security group to restrict inbound traffic to the web tier's IP addresses.
   • CUse AWS PrivateLink to connect the application tier to the third-party API, and do not allow any outbound internet traffic.
   • DUse a network ACL on the application tier's subnet to deny all inbound traffic from the internet, and allow all outbound traffic.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A company processes credit card payments and must comply with the Payment Card Industry Data Security Standard (PCI DSS). Which security control is explicitly required by PCI DSS for cardholder data at rest?

   • AWeb application firewall for all internet-facing applications
   • BFile integrity monitoring on all servers
   • CMulti-factor authentication for all system administrators
   • DEncryption of cardholder data at rest
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. Which IAM mechanism is the recommended way to grant the EC2 instance access without embedding long-term credentials in the application?

   • AAttach an IAM role to the EC2 instance
   • BUse an S3 bucket policy that allows all IAM users
   • CCreate a shared access key and distribute it to the application team
   • DCreate an IAM user and store the access key in the application code
   Reveal Solution Discussion Select an answer first