SOA-C02 Practice Test 43 — 15 Questions

Question 1

A company wants to enforce that all Amazon S3 buckets in their AWS account are encrypted at rest. They have enabled AWS CloudTrail and want to automatically remediate any non-compliant bucket created by users. Which AWS service should they use to achieve this?

Accepted Answer

AWS Config. Option C is correct because AWS Config can evaluate resource configurations against rules and trigger automated remediation using Systems Manager Automation or Lambda. Option A is wrong because AWS Service Catalog is used for creating and managing approved IT services, not for monitoring or remediation. Option B is wrong because AWS Trusted Advisor provides best-practice checks but does not automate remediation. Option D is wrong because Amazon Inspector is for vulnerability assessment, not S3 bucket encryption enforcement.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Service Catalog

Question 2

A SysOps administrator needs to audit all changes to IAM resources in their AWS account. Which THREE AWS services can be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records IAM API calls. Option C is correct because AWS Config can track changes to IAM resources and trigger rules. Option D is correct because Amazon CloudWatch Logs can store and monitor CloudTrail logs. Option B is wrong because Amazon GuardDuty is for threat detection, not auditing changes. Option E is wrong because AWS Trusted Advisor is for best-practice checks.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 3

Which TWO measures help protect an AWS account root user? (Choose two.)

Accepted Answer

Use a strong, complex password for the root user.. Options A and B are correct. Enabling MFA and using a strong password are basic security measures for the root user. Option C is wrong because creating an access key for the root user is not recommended. Option D is wrong because using root user regularly is not a security measure. Option E is wrong because delegating admin tasks to IAM users reduces root user usage.

Answer

Use the root user regularly for administrative tasks.

Answer

Create an access key for the root user for programmatic access.

Answer

Grant other IAM users full administrator access.

Question 4

A company requires that all API calls to AWS services be logged for compliance. The logs must be stored in a centralized S3 bucket with server-side encryption enabled. Which AWS service should be used to capture the API calls?

Accepted Answer

AWS CloudTrail. Option B is correct because AWS CloudTrail logs all API calls and can deliver logs to an S3 bucket with SSE. Option A is wrong because AWS Config records resource configuration changes, not API calls. Option C is wrong because CloudWatch Logs can store logs but is not the primary service for capturing API calls. Option D is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 5

Which THREE are valid methods to control access to an S3 bucket? (Choose three.)

Accepted Answer

Access control lists (ACLs). Option A is correct because bucket policies are a method. Option B is correct because IAM policies can grant access to S3. Option D is correct because ACLs are a legacy method. Option C is wrong because VPC Flow Logs are not access control. Option E is wrong because CloudWatch Logs are not access control.

Answer

VPC Flow Logs

Answer

CloudWatch Logs

Question 6

A company uses IAM roles to grant EC2 instances access to S3 buckets. After a recent security audit, the SysOps administrator must ensure that only instances with a specific tag (Environment=Production) can assume the role. How can this be achieved?

Accepted Answer

Add a condition in the role's trust policy that checks for the instance's tag using the aws:ResourceTag condition key.. Option D is correct because IAM role trust policies can use the aws:ResourceTag condition key to restrict which EC2 instances (based on their tags) can assume the role. Option A is wrong because tags are not automatically included in the session; the trust policy must explicitly check tags. Option B is wrong because SCPs apply to accounts, not instances. Option C is wrong because instance profiles cannot be modified to check tags.

Answer

Create a new IAM role for each instance and attach the tag.

Answer

Use a service control policy (SCP) to deny the ec2:AssumeRole action for instances without the required tag.

Answer

Modify the instance profile to include the tag requirement.

Question 7

A SysOps administrator needs to ensure that an Amazon RDS instance is encrypted at rest. The instance is already provisioned unencrypted. What is the correct approach to enable encryption?

Accepted Answer

Create a snapshot of the instance and restore it with encryption enabled. RDS encryption can only be enabled at creation time. For an existing unencrypted instance, you must create a snapshot, copy it with encryption, and restore from that encrypted snapshot. Modifying the instance or enabling encryption on the fly is not supported.

Answer

Use AWS KMS to encrypt the underlying EBS volumes of the RDS instance

Answer

Enable encryption using the AWS CLI command modify-db-instance

Answer

Modify the RDS instance and enable encryption in the configuration

Question 8

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets in the organization have server-side encryption enabled. What is the MOST efficient way to achieve this?

Accepted Answer

Attach a service control policy (SCP) that denies s3:PutBucketEncryption and s3:CreateBucket actions unless encryption is specified.. Option B is correct because SCPs can be applied to the root OU or specific accounts to deny actions that create or modify S3 buckets without encryption. Option A is wrong because service control policies only prevent actions; they don't automatically enable encryption. Option C is wrong because Config rules can detect non-compliant buckets but cannot enforce encryption automatically. Option D is wrong because bucket policies are per-bucket and cannot be applied globally across all accounts.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets and notify the account owners.

Answer

Use AWS Config rules to automatically remediate non-compliant buckets.

Answer

Apply a bucket policy to each bucket requiring server-side encryption for all uploads.

Question 9

An IAM user has the policy shown in the exhibit. The user is trying to download an object from example-bucket from an IP address of 192.0.2.50. However, the request is denied. What is the most likely reason?

Accepted Answer

The bucket has a bucket policy that denies access from the user's IP address.. Option C is correct because the condition uses aws:SourceIp, which is valid for IAM policies but the bucket policy must also allow the action. Option A is wrong because the condition is correct for IAM policies. Option B is wrong because the action includes all objects. Option D is wrong because the condition is syntactically correct.

Answer

The condition key aws:SourceIp should be aws:SourceIpAddress.

Answer

The resource ARN does not include the bucket itself.

Answer

The condition syntax is incorrect because it should use StringEquals.

Question 10

A SysOps administrator needs to ensure that an Amazon EC2 instance can access an Amazon S3 bucket without storing long-term credentials on the instance. Which approach should be used?

Accepted Answer

Create an IAM role with S3 permissions and attach it to the EC2 instance profile.. Option B is correct because an IAM role attached to an EC2 instance allows the instance to obtain temporary credentials from the instance metadata service. Option A is wrong because storing IAM user credentials on the instance is insecure and not a best practice. Option C is wrong because a bucket policy alone does not grant access to a specific EC2 instance without the instance having AWS credentials. Option D is wrong because security groups control network traffic, not API-level access to S3.

Answer

Configure a security group rule that allows outbound traffic to S3.

Answer

Assign a bucket policy that grants access to the EC2 instance's public IP address.

Answer

Create an IAM user with programmatic access and store the credentials in a file on the instance.

Question 11

A company uses AWS Organizations and wants to restrict the use of specific AWS services across all member accounts. Which TWO methods can be used to enforce these restrictions? (Choose TWO.)

Accepted Answer

Create IAM policies in each account that deny the service actions and attach them to all IAM users and roles.. Option A is correct because SCPs can deny access to services at the organization level. Option C is correct because IAM policies in each account can deny actions, but they need to be applied consistently. Option B is wrong because AWS Config rules can detect but not enforce restrictions. Option D is wrong because AWS Service Catalog provisions services, it does not restrict them. Option E is wrong because VPC endpoints are for network connectivity, not service restrictions.

Answer

Use AWS Config rules to automatically disable non-compliant services.

Answer

Use AWS Service Catalog to block the use of disallowed services.

Answer

Configure VPC endpoints to block traffic to the disallowed services.

Question 12

Refer to the exhibit. An IAM policy is attached to a user. The user's IP address is 10.0.1.5. What is the result when the user tries to download an object from the folder 'confidential' in 'example-bucket'?

Accepted Answer

The request is denied because of the explicit Deny statement.. Option B is correct because the explicit Deny for the 'confidential' folder overrides the Allow. Option A is wrong because the Deny takes precedence. Option C is wrong because the Deny is explicit and not conditional. Option D is wrong because the Deny does not depend on IP address.

Answer

The request is allowed because the Deny statement only applies if the IP is outside the range.

Answer

The request is allowed because the user's IP matches the allowed range.

Answer

The request is denied because the Deny statement applies only when the IP is outside the range.

Question 13

An administrator needs to grant an IAM user the ability to stop and start EC2 instances, but only for instances tagged with 'Environment:Production'. Which IAM policy element should be used to enforce this condition?

Accepted Answer

Condition. Option C is correct because the Condition element in an IAM policy allows specifying conditions like tags. Option A is wrong because Action specifies the allowed actions. Option B is wrong because Resource specifies the resources. Option D is wrong because Effect specifies Allow or Deny.

Answer

Effect

Answer

Resource

Answer

Action

Question 14

Which TWO services can be used to centrally manage cryptographic keys for AWS services? (Choose two.)

Accepted Answer

AWS CloudHSM. Option A is correct because AWS KMS is the managed key service. Option C is correct because AWS CloudHSM provides hardware-based key management. Option B is wrong because ACM manages certificates, not keys. Option D is wrong because IAM manages identities. Option E is wrong because Secrets Manager manages secrets, not cryptographic keys.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Secrets Manager

Question 15

A SysOps administrator is configuring a new AWS account and wants to set up a secure password policy for IAM users. The policy must require at least 12 characters, one uppercase letter, one number, and must prevent password reuse. Where should this policy be configured?

Accepted Answer

In the IAM console under Account settings, set the password policy.. Option A is correct because AWS IAM password policies are configured at the account level in the IAM console or via the update-account-password-policy API. Option B is wrong because there is no password policy for the root user. Option C is wrong because SCPs can restrict IAM actions but do not set password policy. Option D is wrong because IAM roles do not have passwords.

Answer

Apply a service control policy (SCP) that enforces password complexity.

Answer

Set a password policy on the AWS account root user.

Answer

Create an IAM role with a password policy attached.