Determine a strategy to improve security.
11 practice questions under this official exam objective (SAP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
11 total · page 1 of 1How Do You Detect Unsolicited Inbound Traffic in NAT Gateway Flow Logs?
VPC Flow Logs for a NAT gateway are analyzed in Amazon CloudWatch Logs, not CloudTrail, to determine whether inbound traffic from 198.51.100.2 was sol
Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket p
Data scientists run EC2 instances in public subnets of a VPC in a different AWS account from the S3 data lake, and their instances already have a role
Continuously scan EKS nodes and ECR images with Amazon Inspector
Security guidelines require every AWS resource to be continuously scanned for vulnerabilities, and the environment is an EKS cluster with a managed no
Put Amazon Cognito authentication with MFA in front of a Fargate application on an ALB
A third-party Docker image runs as a Fargate service behind an Application Load Balancer, and only a specific list of users may reach it from the inte
Use AWS Config remediation with EBS encryption by default to fix and prevent unencrypted v
A security audit found unencrypted EBS volumes attached to thousands of EC2 instances, and policy requires all of them to be encrypted. The company ne
Give remote engineers VPN access with MFA through AWS Client VPN
A software company has engineers working remotely and runs Active Directory Domain Services on an Amazon EC2 instance. Security policy requires all in
Layer WAF, Inspector, and GuardDuty across an API Gateway API and a legacy EC2 API
The primary API is API Gateway plus Lambda, and several customers also reach a legacy API on a single standalone EC2 instance. The goal is stronger pr
Enforce MFA on S3 CLI access with STS temporary credentials
Cloud engineers must upload objects to an S3 bucket using the AWS CLI with their own IAM user access keys, and every S3 action must require MFA. Each
Enforce OIDC authentication on the ALB so only authenticated users reach the backends
CloudFront fronts two custom origins, an API Gateway HTTP API protected by a JWT authorizer and an Application Load Balancer that a security audit fou
Scan Lambda packages with Inspector and exclude untagged functions from code scanning
A company has Python Lambda functions deployed as .zip packages with a shared Lambda layer also in .zip, both stored in S3. It must automatically scan
Scope S3 access per user with a session-tag condition and audit access with CloudTrail dat
A company wants a single S3 bucket for work documents, authenticates all users through AWS IAM Identity Center, and has a data scientist group. Each d