SAP-C02 Design for New Solutions Practice Question
A company is designing a new application that will be deployed on Amazon EKS. The application must meet PCI DSS compliance requirements. Which TWO steps should the solutions architect take to secure the cluster?
⚠ Common exam trap
It's easy for candidates to confuse auditing (CloudTrail) with security enforcement, or assume that network policies (Calico) or OS hardening (Bottlerocket) are PCI DSS requirements, when the exam specifically tests the two mandatory controls: access management (IAM + RBAC) and encryption at rest (KMS).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure IAM roles and RBAC policies to limit access.
PCI DSS Requirement 7 mandates strict access controls. In Amazon EKS, combining IAM roles for cluster-level authentication with Kubernetes RBAC for namespace-level authorization ensures least-privilege access, which is a core compliance requirement. This dual-layer approach prevents unauthorized API calls and pod-level actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AWS CloudTrail logging for the EKS cluster.
Why it's wrong here
CloudTrail is not a specific PCI requirement for EKS.
- ✗
Install Calico for network policy enforcement.
Why it's wrong here
Calico is a network policy option, but not a PCI-specific requirement.
- ✓
Configure IAM roles and RBAC policies to limit access.
Why this is correct
Access control is required for PCI DSS.
- ✗
Use Bottlerocket as the node operating system.
Why it's wrong here
Bottlerocket is a security-focused OS but not a requirement.
- ✓
Enable secret encryption using AWS KMS.
Why this is correct
Encryption of secrets at rest is required for PCI DSS.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.