SAP-C02 Practice Test 7 — 10 Questions

Question 1

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

Accepted Answer

TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, ensuring confidentiality and integrity between client and server. AWS services like ELB, CloudFront, and API Gateway enforce TLS for all communications, making it the correct choice for securing data in transit.

Answer

AWS Certificate Manager (ACM) for all encryption

Answer

SSL certificates for all connections

Answer

AWS Identity and Access Management (IAM) for data encryption

Question 2

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

Accepted Answer

Use an SCP to require SSE-KMS for all S3 put operations, and apply a bucket policy that only allows access from a specific IAM role.. Using an SCP to require SSE-KMS for all S3 put operations ensures that any log data written to the central bucket is encrypted at rest with AWS KMS, providing an additional layer of control and auditability. The bucket policy that restricts access to a specific IAM role ensures that only authorized security personnel can access the logs, meeting the security team's requirements for encryption and access limitation.

Answer

Enable CloudTrail log file validation and use IAM policies to limit access.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and apply a bucket policy to restrict access.

Answer

Use AWS KMS with a customer managed key and attach an SCP to prevent deletion of the key.

Question 3

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data includes sensitive customer information that must be encrypted at rest. The company also needs to regularly rotate the encryption keys. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation in KMS.. SSE-KMS with automatic key rotation provides encryption at rest with minimal operational overhead. AWS KMS automatically rotates the customer master key (CMK) annually, and you can configure a custom rotation period (e.g., 90 days) if needed. This meets the requirement for regular key rotation without manual intervention, unlike SSE-S3 which does not support key rotation, and SSE-C which requires manual key management.

Answer

Use server-side encryption with S3 managed keys (SSE-S3) and enable S3 bucket key rotation.

Answer

Implement client-side encryption using the AWS Encryption SDK and store keys in AWS Secrets Manager.

Answer

Use server-side encryption with customer-provided keys (SSE-C) and rotate keys manually.

Question 4

A company uses AWS Organizations with 50 accounts. The networking team wants to deploy a shared VPC in the network account and share subnets with other accounts. The shared subnets will host EC2 instances from the consuming accounts. What is the MOST secure way to ensure that only authorized accounts can create resources in the shared subnets?

Accepted Answer

Use AWS Resource Access Manager to share subnets with specific accounts and require that the consuming account uses a service-linked role.. AWS Resource Access Manager (RAM) allows the network account to share subnets with specific consuming accounts, and requiring a service-linked role ensures that only authorized accounts can launch resources in those subnets. This approach provides granular, cross-account subnet sharing without exposing the VPC to unauthorized actions, aligning with the principle of least privilege.

Answer

Use AWS Transit Gateway to route traffic between accounts and rely on route tables to control access.

Answer

Create VPC Peering connections between the network account and each consuming account, and use security groups to restrict access.

Answer

Create an SCP that denies ec2:RunInstances unless the subnet is in the network account.

Question 5

Which TWO actions should a company take to implement a least-privilege access model across multiple AWS accounts? (Choose TWO.)

Accepted Answer

Use IAM roles in each account with cross-account trust from a central identity provider, granting only required permissions.. Using IAM roles with cross-account trust from a central identity provider (e.g., AWS IAM Identity Center or an external IdP) allows users to assume roles in each account with only the permissions required for their tasks. This eliminates the need for long-term credentials and enables centralized access management while adhering to least-privilege principles. Option B is correct because Service Control Policies (SCPs) are applied at the AWS Organizations level to deny high-risk actions across all accounts, providing a guardrail that enforces least-privilege by preventing even privileged users from performing dangerous operations.

Answer

Generate long-term access keys for each user in the central account.

Answer

Share the root user credentials of each account with the central team.

Answer

Create IAM users in each account with full administrator access for all users.

Question 6

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

Accepted Answer

CloudFormation cross-stack references using Export and ImportValue. CloudFormation cross-stack references using the `Export` output attribute and the `Fn::ImportValue` intrinsic function allow you to pass output values from one stack as parameters to another stack within the same AWS account and region. This is the native, recommended mechanism for sharing stack outputs without introducing external services or additional complexity.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Question 7

A company has a multi-account AWS environment with a centralized logging account. The security team needs to collect all Amazon S3 access logs and AWS CloudTrail logs from all accounts into a centralized Amazon S3 bucket in the logging account. Which THREE steps are required to meet this requirement? (Choose THREE.)

Accepted Answer

Enable S3 server access logging on each source bucket to deliver logs to the central S3 bucket.. S3 server access logging can be configured on each source bucket to deliver detailed access logs directly to a central S3 bucket in the logging account. This is a native S3 feature that writes log objects for every request made to the source bucket, satisfying the requirement to collect S3 access logs.

Answer

Create an Amazon CloudWatch Logs subscription filter to stream logs from each account to the central bucket.

Answer

Enable AWS CloudTrail Insights in each account to capture S3 access logs.

Question 8

A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)

Accepted Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.. Enabling MFA delete on the S3 bucket adds an extra layer of security, requiring multi-factor authentication for any delete operations on the bucket or its objects. This prevents unauthorized or accidental deletion of the CloudTrail log bucket, even if an attacker gains full IAM permissions.

Answer

Use IAM groups to restrict access to CloudTrail and S3.

Answer

Store CloudTrail logs in a separate account that only the security team can access.

Question 9

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use ElastiCache for Redis with replication.. ElastiCache for Redis with replication is the most cost-effective solution because it provides durable, low-latency session storage with built-in replication for high availability. Redis supports persistence (e.g., snapshots or AOF logs) to ensure session data survives node failures, and its in-memory nature delivers sub-millisecond latency for frequent reads with rare updates, avoiding the higher costs of DynamoDB on-demand or the lack of durability in Memcached.

Answer

Store session data in Amazon S3 with reduced redundancy.

Answer

Use DynamoDB with on-demand capacity.

Answer

Use ElastiCache for Memcached with multiple nodes.

Question 10

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

Accepted Answer

Access is denied because the IP is not allowed.. The bucket policy explicitly denies access to all principals except those coming from the allowed IP address range (which does not include 198.51.100.5). In AWS IAM, an explicit deny overrides any allow, so the request from IP 198.51.100.5 is denied. Option D is correct because the policy's condition block restricts access to a specific IP range, and the user's IP is not within that range.

Answer

Access is allowed because the Principal is "*".

Answer

Access is denied because the bucket is not public.

Answer

Access is allowed because the policy does not explicitly deny.