Task 5.1: Design and Implement Controls for Data in Transit SCS-C03 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary use case for AWS Client VPN?

   • AEncrypting data at rest in S3
   • BAccelerating content delivery
   • CProviding secure remote access for individual users to VPC resources
   • DConnecting on-premises data centers to AWS
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company wants to provide employees with access to an internal web application hosted on an Application Load Balancer (ALB) in a private subnet. The security team wants to avoid managing a traditional VPN and wants to enforce access based on the user's identity and device posture. What should the security engineer configure?

   • ASet up an AWS Client VPN endpoint and configure it with SAML-based authentication.
   • BCreate an AWS Global Accelerator endpoint and attach it to the ALB.
   • CDeploy AWS Verified Access and attach it to the ALB.
   • DUse AWS WAF to enforce access based on IP addresses and user agents.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company has a VPC with a private subnet that hosts a database application. The application must periodically call the Amazon EC2 API to manage instances. The security team requires that this traffic remain within the AWS network and not use a NAT gateway. What should the security engineer configure?

   • ASet up an AWS Site-to-Site VPN connection to route the traffic through the corporate network.
   • BCreate an interface VPC endpoint for the EC2 API and associate it with the private subnet.
   • CCreate a gateway VPC endpoint for the EC2 API and update the route table.
   • DUse AWS PrivateLink to create a VPC endpoint service and connect to the EC2 API.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a VPC with a private subnet that hosts an application. The application needs to access an Amazon S3 bucket and an Amazon DynamoDB table. The security team requires that all traffic to these services remain within the AWS network and not traverse the public internet. The company wants to minimize the number of VPC endpoints and the associated costs. What should the security engineer implement?

   • AUse AWS PrivateLink to create a VPC endpoint service that proxies requests to S3 and DynamoDB.
   • BCreate one gateway VPC endpoint for S3 and one gateway VPC endpoint for DynamoDB.
   • CCreate a single interface VPC endpoint that provides access to both S3 and DynamoDB.
   • DCreate one interface VPC endpoint for S3 and one interface VPC endpoint for DynamoDB.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A company wants to ensure that all HTTP requests to its Application Load Balancer are automatically redirected to HTTPS. Which configuration should be applied?

   • AConfigure the target group to use HTTPS health checks
   • BSet the load balancer's idle timeout to 60 seconds
   • CAdd a listener rule that redirects HTTP traffic to HTTPS
   • DChange the security group to block port 80
   Reveal Solution Discussion Select an answer first