A company has an S3 bucket that contains sensitive data. They want to ensure that the data is encrypted in transit and that only authorized users can access it. They also want to prevent the data from being accessed from outside the VPC. What should they do?

Use an S3 VPC endpoint with a bucket policy that allows access only from the VPC, and require HTTPS for all requests.

Use AWS PrivateLink to create a VPC endpoint for S3 and use a security group to restrict access to the endpoint.

Use a bucket policy that allows access only from the VPC CIDR range and enable default encryption with SSE-S3.

Use a NAT gateway to route traffic to S3 and use a bucket policy that allows access only from the NAT gateway's IP address.

Which AWS service can be used to automate the patching of EC2 instances to ensure they are up to date with the latest security patches?

AWS Systems Manager Patch Manager

AWSCertified Solutions Architect - Professional

Domain 1Objective 2

Task 1.2: Prescribe Security Controls. SAP-C02 Practice Questions (Page 5)

Part of the Content Domain 1: Design Solutions for Organizational Complexity domain, which makes up ~25% of our current practice bank. AWS does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 4–6 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

8concepts

Questions 21–24

21foundation · easy
Which AWS service can be used to create a runbook for incident response, providing step-by-step guidance and automation for responding to security events?
Select an answer first
22application · medium
A company has an S3 bucket that contains sensitive data. They want to ensure that the data is encrypted in transit and that only authorized users can access it. They also want to prevent the data from being accessed from outside the VPC. What should they do?
Select an answer first
23foundation · easy
Which AWS service can be used to automate the patching of EC2 instances to ensure they are up to date with the latest security patches?
Select an answer first
24foundation · easy
Which AWS service can be used to automate the initial response to a security incident, such as isolating a compromised EC2 instance by changing its security group?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SAP-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SAP-C02” is a trademark of its owner, used for identification only.

Task 1.2: Prescribe Security Controls. SAP-C02 Practice Questions (Page 5)

Questions 21–24

Which AWS service can be used to create a runbook for incident response, providing step-by-step guidance and automation for responding to security events?

A company has an S3 bucket that contains sensitive data. They want to ensure that the data is encrypted in transit and that only authorized users can access it. They also want to prevent the data from being accessed from outside the VPC. What should they do?

Which AWS service can be used to automate the patching of EC2 instances to ensure they are up to date with the latest security patches?

Which AWS service can be used to automate the initial response to a security incident, such as isolating a compromised EC2 instance by changing its security group?

Keep studying — Content Domain 1: Design Solutions for Organizational Complexity