Prescribe security controls.
27 practice questions under this official exam objective (SAP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
27 total · page 1 of 2Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket p
Data scientists run EC2 instances in public subnets of a VPC in a different AWS account from the S3 data lake, and their instances already have a role
Correct the cross-account role trust policy after recreating a role with CloudFormation
A CloudFormation template recreates a role in a child account with the same role name, after which the EC2 instance profile can no longer assume the r
Restrict Amazon WorkSpaces access with an IP access control group
Thin client WorkSpaces must reach clinical trial applications only from company branch office locations, and a new branch office is planned within six
Protecting an S3 bucket from deletion by leaked long-term credentials using Object Lock
To protect existing and future objects against an attacker holding leaked credentials, isolate the data in a security-team account and apply S3 Object
Combine Lambda provisioned concurrency, RDS Reserved Instances, and WAF on CloudFront
A static S3 site behind CloudFront calls API Gateway and Lambda functions that persist to an Aurora MySQL cluster running On-Demand instances with ste
Continuously scan EKS nodes and ECR images with Amazon Inspector
Security guidelines require every AWS resource to be continuously scanned for vulnerabilities, and the environment is an EKS cluster with a managed no
Expose a shared NLB through a VPC endpoint service when CIDR blocks overlap
A centralized EC2 application sits in a shared VPC behind a Network Load Balancer and up to ten business unit VPCs need to reach it. Some business uni
Put Amazon Cognito authentication with MFA in front of a Fargate application on an ALB
A third-party Docker image runs as a Fargate service behind an Application Load Balancer, and only a specific list of users may reach it from the inte
Provisioning IoT devices with a pre-provisioning hook that validates the X.509 serial numb
Sensors ship with an X.509 certificate from a private CA and must not connect until installed. AWS IoT Core Fleet Provisioning with a Lambda pre-provi
Enable AWS Security Hub across the organization with a delegated administrator
A company has created an AWS Control Tower landing zone and its security team will deploy preventive and detective controls across all accounts in the
Use AWS Config remediation with EBS encryption by default to fix and prevent unencrypted v
A security audit found unencrypted EBS volumes attached to thousands of EC2 instances, and policy requires all of them to be encrypted. The company ne
Hardening a CloudFront origin with a secret custom header and WAF
With CloudFront as the only origin for an ALB, an attacker could hit the ALB directly. Storing a random string in Secrets Manager (with rotation), inj
Validate third-party OAuth tokens with an API Gateway Lambda authorizer
A company's web application runs behind an API Gateway HTTP API that invokes a Lambda function, and it already uses a third-party identity provider th
Decrypt PGP uploads in a Transfer Family workflow with the private key from Secrets Manage
A company receives third-party data through an AWS Transfer Family SFTP-enabled server writing to an S3 bucket, and the data is PGP encrypted so it mu
Give remote engineers VPN access with MFA through AWS Client VPN
A software company has engineers working remotely and runs Active Directory Domain Services on an Amazon EC2 instance. Security policy requires all in
Layer WAF, Inspector, and GuardDuty across an API Gateway API and a legacy EC2 API
The primary API is API Gateway plus Lambda, and several customers also reach a legacy API on a single standalone EC2 instance. The goal is stronger pr
Control external API consumption with an API key, usage plan, throttling, and quotas
An API Gateway API backed by Lambda functions is shared with an external development team as its sole consumer, and usage spikes at specific times are
Deny IAM actions for non-administrators with a service control policy at the root
A company manages many accounts with AWS Organizations and must ensure that only administrator roles are allowed to perform IAM actions. The architect
Enforce MFA on S3 CLI access with STS temporary credentials
Cloud engineers must upload objects to an S3 bucket using the AWS CLI with their own IAM user access keys, and every S3 action must require MFA. Each
Enforce OIDC authentication on the ALB so only authenticated users reach the backends
CloudFront fronts two custom origins, an API Gateway HTTP API protected by a JWT authorizer and an Application Load Balancer that a security audit fou