SOA-C02 Practice Test 46 — 15 Questions

Question 1

A SysOps administrator is tasked with encrypting data at rest for an Amazon S3 bucket that stores sensitive customer information. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption solution meets these requirements?

Accepted Answer

Use server-side encryption with Amazon S3-managed keys (SSE-S3).. Option B is correct because SSE-S3 provides server-side encryption with Amazon S3-managed keys, and AWS automatically rotates the keys. Option A is wrong because SSE-C requires the customer to manage and provide the encryption keys. Option C is wrong because SSE-KMS uses customer-managed KMS keys, which are not automatically rotated unless enabled. Option D is wrong because client-side encryption is not managed by AWS.

Answer

Use client-side encryption with AWS KMS.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use server-side encryption with AWS KMS (SSE-KMS).

Question 2

A company wants to grant an IAM role in Account A access to an S3 bucket in Account B. What must be configured?

Accepted Answer

A bucket policy in Account B granting access to the IAM role, and a trust policy in Account A allowing the role to assume the permissions.. Option D is correct because both a bucket policy in Account B and a trust policy in Account A are required for cross-account access. Option A is wrong because a bucket policy alone is insufficient; the role must trust the bucket. Option B is wrong because an IAM role policy in Account A alone is insufficient; the bucket policy must allow access. Option C is wrong because a trust policy is needed in Account A, not Account B.

Answer

A trust policy in Account B allowing the IAM role to access the bucket.

Answer

A bucket policy in Account B allowing access from the IAM role.

Answer

An IAM role in Account A with a policy allowing access to the bucket.

Question 3

A company wants to allow an external auditor to read objects in a specific S3 bucket for 30 days. The auditor does not have an AWS account. Which method should be used?

Accepted Answer

Generate presigned URLs for the objects.. Option C is correct because presigned URLs grant temporary access to specific objects without requiring AWS credentials. Option A is wrong because bucket policies require the auditor to have AWS credentials. Option B is wrong because IAM users require credentials. Option D is wrong because CloudFront does not provide temporary access by itself.

Answer

Create a bucket policy that allows the auditor's IP address.

Answer

Create an IAM user for the auditor and share the credentials.

Answer

Use CloudFront signed URLs.

Question 4

A SysOps administrator needs to share an encrypted AMI with a different AWS account. The AMI uses an AWS KMS key (customer managed key) for EBS encryption. What must be done to allow the target account to launch EC2 instances from the AMI?

Accepted Answer

Modify the AMI launch permissions and add the target account as a principal in the KMS key policy with kms:Decrypt permission.. To share an encrypted AMI with a different account, both the AMI permissions and the KMS key permissions must be updated. Option C is correct because it grants the required permissions. Option A is wrong because modifying launch permissions is not enough; KMS key permissions are also needed. Option B is wrong because sharing the snapshot separately does not grant KMS access. Option D is wrong because re-encrypting with a new key is unnecessary if permissions are properly set.

Answer

Share the underlying EBS snapshot with the target account.

Answer

Re-encrypt the AMI using a new KMS key that is shared with the target account.

Answer

Modify the AMI launch permissions to include the target account.

Question 5

A SysOps administrator is troubleshooting an issue where an IAM user is unable to launch an EC2 instance in a specific subnet. The user has the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:Subnet": "subnet-12345"
        }
      }
    }
  ]
}

What is the likely cause of the failure?

Accepted Answer

The user is not specifying the subnet ID when launching the instance.. Option B is correct because the 'ec2:Subnet' condition key requires the user to specify the subnet ID in the RunInstances call. If the user does not specify a subnet (e.g., using the default VPC), the condition fails. Option A is wrong because the policy allows RunInstances, not just Describe. Option C is wrong because the condition is explicitly for subnet-12345, so it does not deny all subnets. Option D is wrong because the condition key 'ec2:Subnet' is valid for RunInstances.

Answer

The policy does not allow the 'ec2:DescribeSubnets' action, so the user cannot list subnets.

Answer

The policy denies all subnets except subnet-12345.

Answer

The condition key 'ec2:Subnet' is not supported for RunInstances.

Question 6

A company wants to allow a developer to deploy applications using AWS CloudFormation but restrict the developer from creating or modifying IAM resources. Which IAM policy should be used?

Accepted Answer

Allow cloudformation:* and deny iam:*. Option A is correct because it allows all CloudFormation actions but denies IAM-related actions. Option B is wrong because it does not explicitly deny IAM actions, so the developer could still create IAM resources if the policy allows it. Option C is wrong because it denies all actions on CloudFormation stacks, which is too restrictive. Option D is wrong because it allows all actions on IAM, which is the opposite of what is needed.

Answer

Allow iam:*

Answer

Deny cloudformation:*

Answer

Allow cloudformation:* only

Question 7

A SysOps administrator discovers that an EC2 instance was compromised because the SSH key pair was leaked. The administrator wants to ensure that future access to EC2 instances is secured using a method that does not rely on static keys. Which solution should the administrator implement?

Accepted Answer

Use EC2 Instance Connect to connect to instances.. Option C is correct because EC2 Instance Connect allows users to connect using IAM policies and does not require managing SSH keys. Option A is wrong because Systems Manager Session Manager also provides secure access without keys, but it requires the SSM Agent and instance IAM role. Option B is wrong because it is similar to SSH key pairs. Option D is wrong because it still uses key pairs.

Answer

Use a bastion host with a security group that allows SSH from a limited IP range.

Answer

Create a new key pair and distribute it securely to authorized users.

Answer

Use AWS Systems Manager Session Manager to connect to instances.

Question 8

An organization wants to enforce that all IAM users have multi-factor authentication (MFA) enabled before they can perform any action except changing their own password. Which IAM policy element is MOST appropriate?

Accepted Answer

Use a Condition element with 'aws:MultiFactorAuthPresent' set to 'true' in a Deny policy.. Option A is correct because a Condition with 'aws:MultiFactorAuthPresent':'true' can be used to require MFA. Option B is wrong because Resource doesn't enforce MFA. Option C is wrong because Action specifies actions. Option D is wrong because NotAction is not for MFA enforcement.

Answer

Use an Action element to allow only MFA actions.

Answer

Use a NotAction element to allow password change without MFA.

Answer

Use a Resource element to limit access to MFA-enabled users.

Question 9

A company's security team notices that an IAM user has been generating multiple access keys and deleting them within a short period. The SysOps administrator needs to detect and alert on this behavior. Which solution is the MOST effective?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on iam:CreateAccessKey events and sends a notification to an SNS topic.. Option B is correct because AWS CloudTrail logs all IAM API calls, and CloudWatch Events can trigger on the CreateAccessKey event. Option A is wrong because IAM Access Analyzer analyzes resource policies, not user activity. Option C is wrong because AWS Config evaluates resource compliance, not API call patterns. Option D is wrong because Trusted Advisor does not monitor user behavior.

Answer

Enable AWS Trusted Advisor security checks and review the report weekly.

Answer

Enable IAM Access Analyzer to analyze user activity and send alerts.

Answer

Use AWS Config to track IAM user configuration changes and trigger an alert when an access key is created.

Question 10

A company wants to securely store database credentials used by an application running on Amazon EC2. Which AWS service should be used to rotate and manage access to these secrets?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager provides automatic rotation of secrets, while Systems Manager Parameter Store does not offer native rotation. KMS is for encryption keys, not secrets. IAM is for access management, not secret storage.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 11

A SysOps administrator needs to securely transfer a large dataset from an on-premises server to an Amazon S3 bucket. The data is sensitive and must be encrypted in transit and at rest. Which THREE steps should the administrator take? (Choose three.)

Accepted Answer

Create an S3 endpoint policy that only allows access from the on-premises IP range. To securely transfer data, you should enable S3 bucket-side encryption (SSE-KMS or SSE-S3) for encryption at rest, use an S3 endpoint policy to restrict access (e.g., only allow from specific VPC), and use AWS CLI with --sse flag to enforce server-side encryption during upload. While HTTPS is mandatory, it's implicitly used; the explicit steps are the other three. Using public endpoints would expose data; disabling HTTPS would break encryption in transit.

Answer

Disable public access to the S3 bucket

Answer

Use an S3 bucket policy that denies requests unless they are made over HTTPS

Question 12

A company uses an IAM policy that allows s3:GetObject for a specific bucket. However, an IAM user is getting an Access Denied error when trying to download an object. The bucket policy also allows s3:GetObject for the user's account. What is the most likely cause?

Accepted Answer

The bucket policy has a Deny statement that applies to the user.. Option C is correct because if the bucket policy explicitly denies access, that denial overrides any allow. Option A is wrong because if both policies allow, access is allowed. Option B is wrong because KMS permissions are separate. Option D is wrong because SCPs apply to all accounts in the organization.

Answer

The IAM policy does not include the s3:GetObjectVersion action.

Answer

The object is encrypted with a customer-managed KMS key, and the user does not have kms:Decrypt permissions.

Answer

The user's account is part of an AWS Organization with an SCP that denies s3:GetObject.

Question 13

A company requires that all data stored in Amazon S3 be encrypted at rest. Which S3 feature should be enabled to meet this requirement without changing the application code?

Accepted Answer

Enable default encryption on the S3 bucket.. Option A is correct because default encryption automatically encrypts all new objects. Option B is wrong because it requires bucket policies. Option C is wrong because it is a client-side feature. Option D is wrong because it is not a standard S3 feature.

Answer

Use an S3 bucket policy to deny unencrypted uploads.

Answer

Enable S3 Object Lock.

Answer

Use client-side encryption.

Question 14

A company wants to ensure that all data in Amazon S3 is encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be used to deny any PUT request that does not include the 'x-amz-server-side-encryption' header with value 'aws:kms'?

Accepted Answer

Condition: { StringNotEquals: { 's3:x-amz-server-side-encryption': 'aws:kms' } }. Option A is correct because the condition 's3:x-amz-server-side-encryption' checks for the header value. Denying the request when the string does not equal 'aws:kms' enforces SSE-KMS. Option B is wrong because it denies when the value equals 'aws:kms', which would block encryption. Option C is wrong because it checks 's3:x-amz-server-side-encryption-aws-kms-key-id', which is not the header for encryption type. Option D is wrong because it checks 's3:ServerSideEncryption', which is not a valid condition key.

Answer

Condition: { StringNotEquals: { 's3:x-amz-server-side-encryption-aws-kms-key-id': 'alias/aws/s3' } }

Answer

Condition: { StringNotEquals: { 's3:ServerSideEncryption': 'KMS' } }

Answer

Condition: { StringEquals: { 's3:x-amz-server-side-encryption': 'aws:kms' } }

Question 15

Which TWO actions should a SysOps administrator take to secure an S3 bucket that stores sensitive data? (Choose two.)

Accepted Answer

Enable S3 Block Public Access settings on the bucket.. Options A and E are correct. Enabling S3 Block Public Access prevents public access, and enabling S3 server access logging provides audit logs. Option B is wrong because CORS is for cross-origin requests, not security. Option C is wrong because S3 Transfer Acceleration is for faster uploads, not security. Option D is wrong because versioning helps with data protection but not direct security control.

Answer

Enable cross-origin resource sharing (CORS) on the bucket.

Answer

Enable S3 Versioning.

Answer

Enable S3 Transfer Acceleration.