Determine security controls based on requirements.
7 practice questions under this official exam objective (SAP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
7 total · page 1 of 1Which S3 storage solution archives private documents at the lowest cost?
This SAP-C02 scenario asks for the lowest-cost way to serve archived documents privately to employees through a VPC-attached client VPN. S3 One Zone-I
How to Let a New Account Update AWS Config Under Root SCPs?
AWS Organizations SCPs at the root override lower-level allows, so a newly acquired account cannot update AWS Config until the root deny-list SCP is r
Correct the cross-account role trust policy after recreating a role with CloudFormation
A CloudFormation template recreates a role in a child account with the same role name, after which the EC2 instance profile can no longer assume the r
Provisioning IoT devices with a pre-provisioning hook that validates the X.509 serial numb
Sensors ship with an X.509 certificate from a private CA and must not connect until installed. AWS IoT Core Fleet Provisioning with a Lambda pre-provi
Create an hourly EFS backup plan with a dedicated IAM role for a 100-minute RPO
Documents in an encrypted EFS file system must be recoverable within 100 minutes, but the current setup uses the AWS Backup default plan. The default
Hardening a CloudFront origin with a secret custom header and WAF
With CloudFront as the only origin for an ALB, an attacker could hit the ALB directly. Storing a random string in Secrets Manager (with rotation), inj
Use a KMS multi-Region key so one key material encrypts in every Region
An application uses AWS KMS to encrypt data before writing it to an S3 bucket, and the bucket is replicated to other Regions. The application must dec