Q64 — AWS SCS-C02 Ch.1

Question 64 of 100 | ← Chapter 1

A company is planning to migrate its applications to AWS in a single AWS Region.The company's applications will use a combination of Amazon EC2 instances, Elastic Load Balancing(ELB)load balancers,and Amazon S3 buckets.The company wants to complete the migration as quickly as possible.All the applications must meet the following requirements: · Data must be encrypted at rest. ·Data must be encrypted in transit. ·Endpoints must be monitored for anomalous network traffic. Which combination of steps should a security engineer take to meet these requirements with the LEAST effort?(Choose three.)

• A. Install the Amazon Inspector agent on EC2 instances by using AWS Systems Manager Automation.
• B. Enable Amazon GuardDuty in all AWS accounts. ✓
• C. Create VPC endpoints for Amazon EC2 and Amazon S3.Update VPC route tables to use only the secure VPC endpoints.
• D. Configure AWS Certificate Manager(ACM).Configure the load balancers to use certificates from ACM. ✓
• E. Use AWS Key Management Service (AWS KMS) for key management.Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-meta-side-encryption.
• F. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any Putobject command with a condition forx-amz-server-side-encryption. ✓

Correct Answer: B. Enable Amazon GuardDuty in all AWS accounts., D. Configure AWS Certificate Manager(ACM).Configure the load balancers to use certificates from ACM., F. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any Putobject command with a condition forx-amz-server-side-encryption.

Explanation

题目要求确保数据在传输和静止时加密，并监控端点的异常流量。正确答案为B、D、F。Amazon GuardDuty（B）持续监控恶意活动和未经授权的行为，符合监控要求。AWS Certificate Manager（D）为负载均衡器提供托管的SSL/TLS证书，轻松实现传输加密。AWS KMS结合S3存储桶策略（F）强制服务端加密，使用正确条件`x-amz-server-side-encryption`来拒绝未加密的上传，确保静态数据加密。选项A涉及漏洞评估，与流量监控无关；选项C的VPC端点配置不属于题目核心需求；选项E的错误条件无法有效强制加密。