Task 1.2: Prescribe Security Controls. SAP-C02 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has an incident response plan that requires the security team to have access to a pre-configured forensic environment in a separate AWS account. The environment should include a VPC, a forensic workstation, and necessary tools. The team wants to be able to launch this environment quickly during an incident. What should they do?

   • AUse AWS Organizations to create a new account with a pre-configured VPC and EC2 instance, and use AWS SSM to run commands on the instance.
   • BUse AWS Elastic Beanstalk to deploy a pre-configured forensic environment and use AWS CodePipeline to update it.
   • CUse AWS Launch Wizard to deploy a forensic environment and use AWS Config to ensure it is compliant.
   • DCreate an AWS CloudFormation template that defines the forensic environment and use AWS Systems Manager Automation to launch it when needed.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A solutions architect needs to control traffic at the subnet level in a VPC, allowing or denying traffic based on IP addresses and ports. Which AWS service or feature should be used?

   • AAWS Shield
   • BNetwork ACL
   • CAWS WAF
   • DRoute table
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An organization wants to enforce least privilege for its IAM users. Which IAM feature is designed to help identify and refine overly permissive policies?

   • AIAM policy validator
   • BIAM policy simulator
   • CIAM Access Analyzer
   • DIAM Access Advisor
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is designing a new VPC for a multi-tier application. They want to ensure that the web tier can only be accessed from the internet on port 443, and the application tier can only be accessed from the web tier on port 8080. The database tier should only be accessible from the application tier on port 3306. What should they do?

   • AUse security groups: one for the web tier allowing inbound 443 from 0.0.0.0/0, one for the app tier allowing inbound 8080 from the web security group, and one for the DB tier allowing inbound 3306 from the app security group.
   • BUse AWS WAF to filter traffic to the web tier and security groups for the app and DB tiers.
   • CUse a combination of security groups and network ACLs: security groups for the web tier and network ACLs for the app and DB tiers.
   • DUse network ACLs: one for each subnet with rules to allow the required ports and deny all other traffic.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses AWS Organizations with multiple accounts. The security team needs to ensure that any new S3 bucket created in any account is automatically tagged with the owner's email and that all existing buckets without the tag are identified. They want to avoid manual effort and prefer a solution that uses AWS-native services. What should the security team do?

   • AEnable AWS CloudTrail management events, create an Amazon EventBridge rule for 'CreateBucket' API calls, and invoke an AWS Lambda function that tags the bucket with the IAM user's email. Use AWS Config to identify existing untagged buckets.
   • BUse AWS Config managed rule 's3-bucket-tags-exists' with an auto-remediation action that applies the required tag, and run the rule across all accounts in the organization.
   • CDeploy an AWS CloudTrail data event for PutBucketTagging and trigger a Lambda function to tag the bucket with the IAM user's email.
   • DCreate an S3 lifecycle policy to add tags to all buckets and use S3 Inventory to list untagged buckets.
   Reveal Solution Discussion Select an answer first