SCS-C02 · Question #448
A company is planning to migrate its applications to AWS in a single AWS Region. The company's applications will use a combination of Amazon EC2 instances, Elastic Load Balancing (ELB) load…
The correct answer is B. Enable Amazon GuardDuty in all AWS accounts. D. Configure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from F. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket. Enable Amazon GuardDuty in all AWS accounts: GuardDuty provides anomaly detection and monitors for suspicious activity on AWS resources, fulfilling the requirement for endpoint monitoring with minimal setup. Configure AWS Certificate Manager (ACM). Configure the load balancers…
Question
A company is planning to migrate its applications to AWS in a single AWS Region. The company's applications will use a combination of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, and Amazon S3 buckets. The company wants to complete the migration as quickly as possible. All the applications must meet the following requirements:
- Data must be encrypted at rest.
- Data must be encrypted in transit.
- Endpoints must be monitored for anomalous network traffic.
Which combination of steps should a security engineer take to meet these requirements with the LEAST effort? (Choose three.)
Options
- AInstall the Amazon Inspector agent on EC2 instances by using AWS Systems Manager
- BEnable Amazon GuardDuty in all AWS accounts.
- CCreate VPC endpoints for Amazon EC2 and Amazon S3. Update VPC route tables to use only
- DConfigure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from
- EUse AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket
- FUse AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket
How the community answered
(16 responses)- A6% (1)
- B75% (12)
- C6% (1)
- E13% (2)
Explanation
Enable Amazon GuardDuty in all AWS accounts: GuardDuty provides anomaly detection and monitors for suspicious activity on AWS resources, fulfilling the requirement for endpoint monitoring with minimal setup. Configure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from ACM: ACM provides and manages SSL/TLS certificates for encrypting data in transit through ELB load balancers. This ensures that data transmitted to and from the load balancers is encrypted, meeting the requirement for encryption in transit. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-server-side-encryption: KMS handles encryption at rest, and the S3 bucket policy enforces server-side encryption by denying requests that do not specify encryption. This meets the requirement for data encryption at rest.
Topics
Community Discussion
No community discussion yet for this question.