SOA-C02 Practice Test 15 — 15 Questions

Question 1

A company uses S3 to store sensitive data. To meet compliance requirements, all S3 buckets must be encrypted at rest. The security team notices that some objects in a bucket are not encrypted. What is the MOST efficient way to enforce encryption for all future objects?

Accepted Answer

Create an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption header is not present. Option D is correct because using a bucket policy to deny PutObject requests without the x-amz-server-side-encryption header ensures that any object uploaded without encryption is rejected. Option A is incorrect because S3 default encryption applies only to new objects, but objects can still be uploaded without encryption if the request explicitly specifies otherwise. Option B is incorrect because S3 inventory does not enforce encryption; it only reports. Option C is incorrect because manually re-uploading is not efficient and does not prevent future violations.

Answer

Use AWS Config managed rule to identify unencrypted objects and re-upload them manually

Answer

Use S3 Inventory to list unencrypted objects and apply encryption via S3 Batch Operations

Answer

Enable default encryption on the bucket using AES-256

Question 2

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences variable traffic patterns. What is the MOST cost-effective way to ensure the application scales based on demand?

Accepted Answer

Use EC2 Auto Scaling with a target tracking scaling policy based on average CPU utilization.. Option C is correct because a target tracking scaling policy automatically adjusts capacity based on a CloudWatch metric, which is cost-effective compared to manual or scheduled scaling. Option A is wrong because manual scaling is not automated. Option B is wrong because scheduled scaling does not handle variable traffic well. Option D is wrong because it over-provisions instances.

Answer

Provision a fixed number of EC2 instances that can handle peak load at all times.

Answer

Use EC2 Auto Scaling with a scheduled scaling policy that adds instances during business hours.

Answer

Use EC2 Auto Scaling with a manual scaling plan that requires an administrator to adjust the desired capacity.

Question 3

A company stores 1 PB of data in Amazon S3 Standard. The data is accessed frequently for the first 30 days, then rarely accessed afterwards. The company needs to optimize storage costs. What should they do?

Accepted Answer

Configure an S3 Lifecycle policy to transition objects to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 90 days.. Option D is correct because an S3 Lifecycle policy automatically transitions objects to colder storage classes based on age. Option A is wrong because deleting data loses it. Option B is wrong because S3 Intelligent-Tiering has a monitoring cost per object. Option C is wrong because manual transitions are not scalable.

Answer

Move all objects to S3 Intelligent-Tiering immediately.

Answer

Delete objects older than 30 days using S3 Lifecycle expiration.

Answer

Manually change the storage class of each object to S3 Glacier Deep Archive after 30 days.

Question 4

A company requires that all access to the AWS Management Console be protected by multi-factor authentication (MFA). The SysOps administrator has enabled an IAM policy that denies all actions if the user does not authenticate with MFA. However, some users report they cannot list their own MFA devices. What is the MOST likely cause?

Accepted Answer

The policy denies the iam:ListMFADevices action without an MFA-authenticated session. Option B is correct because the policy that denies actions without MFA also blocks the action to list MFA devices, which is needed to set up MFA. The policy should include an exception for the iam:ListMFADevices action. Option A is incorrect because the problem is not that users are not using MFA; it's that they cannot list devices to set up MFA. Option C is incorrect because the policy is not limited to a specific region. Option D is incorrect because IAM is not region-specific.

Answer

The policy is applied to the root user only

Answer

Users are not using MFA-enabled access keys

Answer

The policy is not applied in the us-east-1 region

Question 5

A SysOps administrator needs to ensure that all Amazon S3 buckets in an AWS account are encrypted at rest using server-side encryption. Which combination of actions should be taken to enforce this policy?

Accepted Answer

Use an S3 bucket policy on each bucket that denies s3:PutObject if the x-amz-server-side-encryption header is not present.. Option D is correct because using an S3 bucket policy with a Deny for s3:PutObject without the x-amz-server-side-encryption header enforces encryption at upload time. Option A is wrong because bucket policies cannot be applied to all buckets at once; each bucket needs its own policy. Option B is wrong because enabling default encryption on existing buckets does not prevent unencrypted uploads (default applies if no header is specified). Option C is wrong because CloudTrail can log but not enforce encryption.

Answer

Enable default encryption on each S3 bucket and create a CloudWatch alarm to notify if unencrypted objects are uploaded.

Answer

Use an S3 bucket policy with a Deny statement for s3:PutObject without encryption applied to all buckets via a single policy.

Answer

Use AWS CloudTrail to monitor PutObject calls and trigger an AWS Lambda function to delete unencrypted objects.

Question 6

A company uses AWS CloudTrail to log all API calls. The security team requires that all logs be encrypted at rest and stored in an S3 bucket that blocks public access. The SysOps administrator configures the bucket with default encryption (SSE-S3) and a bucket policy that denies all actions unless the request includes the x-amz-server-side-encryption header with value AES256. However, CloudTrail delivery fails. What is the MOST likely cause?

Accepted Answer

The bucket policy requires the x-amz-server-side-encryption header, but CloudTrail does not include this header. Option C is correct because CloudTrail delivers logs using SSE-S3 by default, but it does not include the x-amz-server-side-encryption header in the PutObject requests. The bucket policy requires that header, so the requests are denied. Option A is incorrect because CloudTrail can deliver to buckets with default encryption. Option B is incorrect because the bucket policy does not need to allow CloudTrail explicitly; the service has permissions via the trail's bucket policy. Option D is incorrect because SSE-S3 is supported by CloudTrail.

Answer

CloudTrail does not support SSE-S3 encryption

Answer

The bucket policy does not grant CloudTrail the s3:PutObject permission

Answer

The bucket has default encryption enabled, which conflicts with CloudTrail's encryption

Question 7

A company is using AWS Organizations with multiple accounts. The security team wants to prevent any IAM user from creating access keys for themselves across all accounts. What is the most effective way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that denies iam:CreateAccessKey to all accounts in the organization.. Option C is correct because a service control policy (SCP) can deny the CreateAccessKey action across all accounts in the organization. Option A is wrong because an IAM policy on the root user only affects the root user, not IAM users. Option B is wrong because password policies do not control access keys. Option D is wrong because CloudTrail can log but not prevent the action.

Answer

Attach an IAM policy to the root user that denies iam:CreateAccessKey.

Answer

Configure an IAM password policy that requires strong passwords.

Answer

Use AWS CloudTrail to monitor and alert on CreateAccessKey events.

Question 8

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The company security policy requires that credentials are not stored on the instance. What is the most secure way to grant access?

Accepted Answer

Create an IAM role with S3 access permissions and attach it to the EC2 instance profile.. Option D is correct because an IAM role attached to the EC2 instance provides temporary credentials via the instance metadata service, avoiding long-term credentials. Option A is wrong because storing access keys in a file violates security policy. Option B is wrong because environment variables still expose credentials. Option C is wrong because S3 bucket policies alone do not grant access to the instance; the instance needs an IAM role or user credentials.

Answer

Generate an access key and secret key for an IAM user, then store them in a configuration file on the instance.

Answer

Create an S3 bucket policy that allows access from the instance's public IP address.

Answer

Define the access keys as environment variables in the user data script when launching the instance.

Question 9

A SysOps administrator needs to allow an IAM user to launch EC2 instances only in the us-east-1 region. The administrator creates a policy with a condition that uses the aws:RequestedRegion condition key. However, the user can still launch instances in other regions. What is the MOST likely reason?

Accepted Answer

The policy does not include the ec2:RunInstances action with the condition. Option A is correct because the ec2:RunInstances action is global; the aws:RequestedRegion condition works only for regional service endpoints. Some EC2 actions are global, and the condition may not apply. However, the primary reason is that the condition key aws:RequestedRegion is evaluated only for regional service calls; if the user uses a global endpoint, the condition might not match. But more commonly, the policy might not include the condition for all EC2 actions. Option B is incorrect because the condition key is valid. Option C is incorrect because the policy can restrict to a region. Option D is incorrect because the condition is available.

Answer

The aws:RequestedRegion condition key is not supported for EC2

Answer

The condition key must be aws:Region instead of aws:RequestedRegion

Answer

The user has administrator access that overrides the policy

Question 10

A company uses AWS Key Management Service (KMS) to encrypt data in S3. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Use a KMS key policy with a condition that requires the encryption context to match the bucket ARN, and grant the IAM role decrypt permissions. Option B is correct because by adding a condition in the KMS key policy that requires the encryption context to match the bucket name, you can restrict decryption to only requests that include that context. The IAM role can then be allowed to use the key with that context. Option A is incorrect because bucket policies cannot restrict decrypt actions; they can only enforce encryption. Option C is incorrect because S3 bucket policies do not control KMS decrypt permissions. Option D is incorrect because using a different key for each bucket is cumbersome and does not restrict to a specific role.

Answer

Create a separate KMS key for each bucket and assign the IAM role as a key user

Answer

Configure an S3 bucket policy that allows only the IAM role to perform s3:GetObject

Answer

Use an S3 bucket policy that denies s3:GetObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header

Question 11

A SysOps administrator needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records API calls, including IAM policy changes. Option B is wrong because AWS Config records resource configuration changes but not all API calls; it can track IAM policy changes via rules but CloudTrail is more direct for auditing API calls. Option C is wrong because CloudWatch Logs can store logs but does not capture them initially. Option D is wrong because S3 is a storage service, not a logging service.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3

Question 12

A company has an AWS account with multiple VPCs connected via a transit gateway. The security team wants to centrally manage VPC security group rules and ensure compliance. Which approach is most effective?

Accepted Answer

Use AWS Firewall Manager to centrally define and enforce security group rules across all VPCs.. Option C is correct because AWS Firewall Manager allows centralized management of security group rules across accounts and VPCs. Option A is wrong because security groups are per-VPC and cannot be applied across multiple VPCs. Option B is wrong because network ACLs are stateless and not a replacement for security groups; also, they are per-subnet. Option D is wrong because CloudFormation can deploy but not centrally manage ongoing rule enforcement.

Answer

Create a single security group and attach it to all VPCs.

Answer

Define security group rules in AWS CloudFormation templates and deploy them to each VPC.

Answer

Use network ACLs instead of security groups for centralized management.

Question 13

A company is using AWS KMS to encrypt data at rest. Which TWO actions can be taken to audit the usage of a customer managed key?

Accepted Answer

Enable AWS CloudTrail to log KMS API calls.. Correct options: A and C. Option A is correct because CloudTrail logs KMS API calls like Encrypt and Decrypt. Option C is correct because CloudWatch Logs can be used to store and monitor KMS API logs. Option B is wrong because AWS Config does not track KMS key usage; it tracks configuration changes. Option D is wrong because IAM access analyzer identifies resources shared with external entities, not key usage. Option E is wrong because S3 server access logs are for S3 access, not KMS.

Answer

Enable Amazon S3 server access logs to track KMS operations.

Answer

Use IAM Access Analyzer to review KMS key policies.

Answer

Use AWS Config rules to monitor KMS key usage.

Question 14

A SysOps administrator needs to ensure that an Amazon S3 bucket is not publicly accessible. Which THREE actions should be taken to prevent public access?

Accepted Answer

Configure the bucket to block new public ACLs using S3 Object Ownership.. Correct options: A, C, E. Option A is correct because blocking public access at the bucket level prevents any public policies or ACLs. Option C is correct because removing public ACLs ensures no objects are publicly accessible. Option E is correct because disabling public ACLs via S3 Object Ownership prevents future public ACLs. Option B is wrong because deleting the bucket policy does not address public ACLs. Option D is wrong because enabling versioning does not affect public access.

Answer

Enable versioning on the bucket.

Answer

Delete the bucket policy if it exists.

Question 15

A company has a VPN connection between its on-premises network and AWS VPC. The VPN tunnel shows status as UP, but traffic is not flowing from on-premises to the VPC. Which configuration should be checked?

Accepted Answer

The route tables in the VPC have routes pointing to the virtual private gateway for the on-premises CIDR.. Option B is correct because the route tables in the VPC must have routes pointing to the virtual private gateway for the on-premises network. Without them, traffic from the VPC to on-premises will not be routed. Option A is wrong because the tunnel state is UP, indicating Phase 1 and Phase 2 are fine. Option C is wrong because the customer gateway device must have correct routing, but the question is about VPC side. Option D is wrong because security groups control traffic to/from instances, but if routing is missing, traffic won't reach the VPN.

Answer

The IKE versions on the customer gateway and virtual private gateway match.

Answer

The customer gateway device is configured to forward traffic to the VPC.

Answer

The security groups allow inbound traffic from the on-premises network.