A company runs a critical application on EC2 instances that communicate with each other over the network. The security team wants to ensure that data in transit between these instances is encrypted at the network layer without requiring application-level changes. What should the security engineer do?

Enable VPC Flow Logs to monitor and encrypt traffic between instances.

Use EC2 instances that support the AWS Nitro System and enable Nitro encryption for traffic between them.

Use AWS PrivateLink to create a connection between the instances.

Configure a VPN connection between the instances using AWS Client VPN.

A data science team uses Amazon SageMaker AI to train a model on a large dataset. The security team requires that data transferred between the SageMaker training instances and the S3 bucket be encrypted in transit. What should the security engineer configure?

Enable VPC mode for the SageMaker training job and use a VPC endpoint for S3.

Enable SageMaker's built-in encryption for data in transit by setting the EnableInterNodeTrafficEncryption parameter.

Encrypt the S3 bucket with SSE-KMS and rely on that for in-transit encryption.

Use AWS PrivateLink to create a VPC endpoint for SageMaker and route all training traffic through it.

AWSCertified Security - Specialty

Domain 5Objective 1

Task 5.1: Design and Implement Controls for Data in Transit SCS-C03 Practice Questions (Page 4)

Part of the Content Domain 5: Data Protection domain, which accounts for 18% of the SCS-C03 exam. AWS does not publish an official question count, but from its 170-minute exam (~70–115 total, ~13–21 in this domain), expect 4–7 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

10concepts

18%of the exam

Questions 16–20

16application · medium
A company runs a critical application on EC2 instances that communicate with each other over the network. The security team wants to ensure that data in transit between these instances is encrypted at the network layer without requiring application-level changes. What should the security engineer do?
Select an answer first
17foundation · easy
Which AWS resource type has a configurable security policy that specifies the TLS version and cipher suites for client connections?
Select an answer first
18application · medium
A data science team uses Amazon SageMaker AI to train a model on a large dataset. The security team requires that data transferred between the SageMaker training instances and the S3 bucket be encrypted in transit. What should the security engineer configure?
Select an answer first
19foundation · easy
In SageMaker AI, which setting controls encryption of data in transit between training instances?
Select an answer first
20foundation · easy
Which AWS service provides secure access to applications without requiring a traditional VPN connection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCS-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SCS-C03” is a trademark of its owner, used for identification only.

Task 5.1: Design and Implement Controls for Data in Transit SCS-C03 Practice Questions (Page 4)

Questions 16–20

Which AWS resource type has a configurable security policy that specifies the TLS version and cipher suites for client connections?

A data science team uses Amazon SageMaker AI to train a model on a large dataset. The security team requires that data transferred between the SageMaker training instances and the S3 bucket be encrypted in transit. What should the security engineer configure?

In SageMaker AI, which setting controls encryption of data in transit between training instances?

Which AWS service provides secure access to applications without requiring a traditional VPN connection?

Keep studying — Content Domain 5: Data Protection