A financial services company is migrating to AWS and must comply with PCI DSS. They need to ensure that cardholder data is encrypted in transit and at rest, and that access to this data is restricted to a small group of administrators. What should they do?

Use AWS KMS to create a customer-managed key for S3 encryption, enable TLS on the load balancer, and create an IAM policy that allows only the administrators group to use the KMS key for decrypt and to access the S3 bucket.

Use AWS Certificate Manager (ACM) to issue TLS certificates for all load balancers, enable S3 default encryption with SSE-KMS, and create an IAM group for administrators with a policy that allows full access to the S3 bucket.

Place the S3 bucket in a VPC endpoint and use a VPC endpoint policy to allow only the administrators group to access the bucket.

Use S3 bucket policies to restrict access to the bucket based on the source IP address of the administrators, and enable default encryption with SSE-S3.

AWSCertified Solutions Architect - Professional

Domain 1Objective 2

Task 1.2: Prescribe Security Controls. SAP-C02 Practice Questions (Page 3)

Part of the Content Domain 1: Design Solutions for Organizational Complexity domain, which makes up ~25% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 4–6 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

8concepts

Questions 11–15

11foundation · easy
A solutions architect is designing a security control framework for a new AWS environment. Which AWS service provides a centralized way to define and enforce security controls across accounts and regions?
Select an answer first
12foundation · easy
Which AWS VPC component acts as a stateful firewall at the instance level, controlling inbound and outbound traffic for one or more EC2 instances?
Select an answer first
13foundation · easy
Which AWS service provides continuous threat detection by analyzing AWS logs and network activity for malicious behavior?
Select an answer first
14foundation · easy
Which AWS service can be used to automatically remediate non-compliant resources by triggering actions when a configuration change is detected?
Select an answer first
15application · medium
A financial services company is migrating to AWS and must comply with PCI DSS. They need to ensure that cardholder data is encrypted in transit and at rest, and that access to this data is restricted to a small group of administrators. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 1.2: Prescribe Security Controls. SAP-C02 Practice Questions (Page 3)

Questions 11–15

A solutions architect is designing a security control framework for a new AWS environment. Which AWS service provides a centralized way to define and enforce security controls across accounts and regions?

Which AWS VPC component acts as a stateful firewall at the instance level, controlling inbound and outbound traffic for one or more EC2 instances?

Which AWS service provides continuous threat detection by analyzing AWS logs and network activity for malicious behavior?

Which AWS service can be used to automatically remediate non-compliant resources by triggering actions when a configuration change is detected?

A financial services company is migrating to AWS and must comply with PCI DSS. They need to ensure that cardholder data is encrypted in transit and at rest, and that access to this data is restricted to a small group of administrators. What should they do?

Keep studying — Content Domain 1: Design Solutions for Organizational Complexity