A company has a VPC with a public subnet and a private subnet. They want to allow instances in the private subnet to access the internet for software updates, but they do not want to allow inbound traffic from the internet. They also want to ensure that all traffic to the internet is encrypted. What should they do?

Use an internet gateway and route the private subnet's traffic directly to it. Use a security group to allow outbound HTTPS.

Use a VPC endpoint for S3 to allow access to software updates, and use a security group to allow outbound HTTPS.

Use a NAT gateway in the public subnet and route the private subnet's traffic to it. Use a security group on the instances to allow outbound HTTPS.

Use a NAT instance in the public subnet and configure it to forward traffic. Use a network ACL to block inbound traffic.

A company has an incident response plan that requires the security team to be able to take snapshots of EBS volumes and launch a forensic instance in a separate VPC for analysis. They want to automate this process as much as possible. What should they do?

Create an AWS Lambda function that is manually invoked by the security team to create snapshots and launch a forensic instance.

Use Amazon EventBridge to schedule a snapshot of all EBS volumes every hour.

Use AWS Config rules to detect changes to EBS volumes and automatically create snapshots.

Use AWS Systems Manager Automation to create a runbook that takes snapshots and launches a forensic instance, and trigger it via an SNS topic.

Which AWS service is used to create and manage encryption keys for encrypting data at rest in AWS services such as S3, EBS, and RDS?

AWS Key Management Service (KMS)

AWSCertified Solutions Architect - Professional

Domain 1Objective 2

Task 1.2: Prescribe Security Controls. SAP-C02 Practice Questions (Page 2)

Part of the Content Domain 1: Design Solutions for Organizational Complexity domain, which makes up ~25% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 4–6 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

8concepts

Questions 6–10

6expert · hard
A company has a VPC with a public subnet and a private subnet. They want to allow instances in the private subnet to access the internet for software updates, but they do not want to allow inbound traffic from the internet. They also want to ensure that all traffic to the internet is encrypted. What should they do?
Select an answer first
7application · medium
A company has an incident response plan that requires the security team to be able to take snapshots of EBS volumes and launch a forensic instance in a separate VPC for analysis. They want to automate this process as much as possible. What should they do?
Select an answer first
8foundation · easy
An organization needs to demonstrate compliance with the Payment Card Industry Data Security Standard (PCI DSS) for its AWS environment. Which AWS service can help automate compliance checks against PCI DSS requirements?
Select an answer first
9foundation · easy
Which AWS service is used to create and manage encryption keys for encrypting data at rest in AWS services such as S3, EBS, and RDS?
Select an answer first
10foundation · easy
A solutions architect needs to grant an IAM role temporary credentials to access an S3 bucket. Which IAM feature should be used to obtain these temporary credentials?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 1.2: Prescribe Security Controls. SAP-C02 Practice Questions (Page 2)

Questions 6–10

A company has an incident response plan that requires the security team to be able to take snapshots of EBS volumes and launch a forensic instance in a separate VPC for analysis. They want to automate this process as much as possible. What should they do?

An organization needs to demonstrate compliance with the Payment Card Industry Data Security Standard (PCI DSS) for its AWS environment. Which AWS service can help automate compliance checks against PCI DSS requirements?

Which AWS service is used to create and manage encryption keys for encrypting data at rest in AWS services such as S3, EBS, and RDS?

A solutions architect needs to grant an IAM role temporary credentials to access an S3 bucket. Which IAM feature should be used to obtain these temporary credentials?

Keep studying — Content Domain 1: Design Solutions for Organizational Complexity