SOA-C02 Practice Test 49 — 15 Questions

Question 1

A SysOps administrator applies the IAM policy shown in the exhibit to an IAM user. The user tries to upload an object to the S3 bucket without specifying encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. Option B is correct because the policy requires SSE-S3 (AES256), and if the user does not specify encryption, the request does not satisfy the condition, so the action is denied. Option A is wrong because the condition is not met. Option C is wrong because the policy does not allow unencrypted uploads. Option D is wrong because the condition is not met.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-KMS encryption.

Answer

The upload succeeds with default encryption.

Question 2

A SysOps administrator deploys the CloudFormation template shown in the exhibit. The stack creation fails with a security group error. What is the most likely cause?

Accepted Answer

The template uses 'SecurityGroups' instead of 'SecurityGroupIds' for a VPC instance.. Option C is correct because the security group ingress rule uses a CIDR that is not a specific IP range; although 10.0.0.0/8 is private, it is allowed, but the error might be due to missing VPC reference. However, more importantly, the security group is created without a VPC ID, which is required for EC2-Classic? Actually, in EC2-VPC, security groups must be in a VPC. The template does not specify a VPC, so it uses the default VPC. But the most likely cause is that the security group ingress rule allows SSH from a large CIDR, which is a security risk but not a failure. Actually, the error is likely because the security group is not associated with a VPC? Wait, the template does not specify VpcId, so it uses the default VPC. But if the default VPC does not exist, it fails. However, a more common issue is that the security group ingress rule uses a CidrIp that is not valid for the VPC. But the exhibit shows 10.0.0.0/8, which is valid. Actually, the most likely cause is that the security group is not associated with a VPC, but that is automatically handled. Alternatively, the error could be because the security group name is already used. But the most plausible is that the security group ingress rule is malformed because it should specify CidrIp or SourceSecurityGroup, and it does. I'll go with option C: The security group ingress rule uses a CIDR that is not allowed in the VPC (10.0.0.0/8 is private, but it's allowed). Hmm, let's reconsider. The template has a bug: it uses "SecurityGroups" (plural) instead of "SecurityGroupIds" or "SecurityGroups" is a list of group names, but it's referencing a Ref to a security group, which returns the group ID, not name. So the correct property is "SecurityGroupIds" for VPC. That is a common mistake. So option A could be correct. I'll set option A as correct: The template uses "SecurityGroups" instead of "SecurityGroupIds" for a VPC instance. So the answer is A.

Answer

The AMI ID is incorrect.

Answer

The security group ingress rule uses an invalid CIDR.

Answer

The security group ingress rule allows SSH from all IPs.

Question 3

A company wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which TWO steps should be taken? (Choose two.)

Accepted Answer

Create an IAM policy that denies access without MFA.. Option A is correct because you must first enable MFA on each user's account. Option D is correct because you need an IAM policy that denies access if MFA is not present. Option B is wrong because AWS does not have a global MFA setting. Option C is wrong because trust policy is for roles. Option E is wrong because CloudTrail does not enforce MFA.

Answer

Use AWS CloudTrail to monitor MFA usage.

Answer

Enable MFA at the AWS account level.

Answer

Modify the IAM role trust policy to require MFA.

Question 4

A company needs to audit all changes to AWS resources. Which THREE AWS services should be used together to achieve this? (Choose three.)

Accepted Answer

AWS CloudTrail. Option A is correct because AWS Config records resource configuration changes. Option B is correct because CloudTrail records API calls. Option D is correct because CloudWatch Events can trigger notifications. Option C is wrong because Inspector is for security assessments. Option E is wrong because Trusted Advisor is for best practices.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 5

A company wants to provide temporary access to an S3 bucket for a third-party vendor. The vendor needs to upload files for one hour. Which approach should be used?

Accepted Answer

Generate a presigned URL for the S3 bucket that expires in one hour.. Option A is correct because presigned URLs can grant temporary access to a specific S3 object for a limited time. Option B is wrong because a bucket policy with a condition on the source IP would provide permanent access. Option C is wrong because creating an IAM user for the vendor is a long-term credential. Option D is wrong because cross-account roles require the vendor to have an AWS account.

Answer

Create an IAM role and allow the vendor to assume it using their AWS account.

Answer

Create an IAM user with programmatic access and share the credentials with the vendor.

Answer

Create an S3 bucket policy that allows the vendor's IP address for one hour.

Question 6

Which TWO IAM policy conditions can be used to enforce multi-factor authentication (MFA) for API calls? (Choose two.)

Accepted Answer

aws:MultiFactorAuthPresent. Options A and C are correct. The condition key 'aws:MultiFactorAuthPresent' checks if MFA was used. The condition key 'aws:MultiFactorAuthAge' checks how long ago MFA was authenticated. Option B is wrong because 'aws:TokenIssueTime' is not a valid condition key. Option D is wrong because 'aws:SourceIp' is for IP address. Option E is wrong because 'aws:PrincipalType' is for principal type.

Answer

aws:PrincipalType

Answer

aws:TokenIssueTime

Answer

aws:SourceIp

Question 7

A SysOps administrator runs the AWS CLI command shown in the exhibit. What is the purpose of this command?

Accepted Answer

To retrieve details about the most recent console login events.. Option D is correct. The command looks up CloudTrail events with the event name 'ConsoleLogin', which are sign-in events to the AWS Management Console. Option A is wrong because it filters by event name, not user. Option B is wrong because it looks up events, not modifies. Option C is wrong because it returns events, not just counts.

Answer

To count the number of console logins in the last 5 minutes.

Answer

To retrieve a list of all API calls made by the user john.doe.

Answer

To disable CloudTrail logging for console login events.

Question 8

A SysOps administrator is troubleshooting an IAM policy that is not granting the expected permissions. The policy has a Deny effect on a specific action, but the user is still able to perform that action. What is the most likely reason?

Accepted Answer

The Deny statement includes a condition that is not met by the request. IAM policy evaluation logic: by default, all requests are denied. An explicit allow overrides the default deny. An explicit deny overrides any allow. If a Deny is not being enforced, it could be because the policy is not attached to the user, group, or role. However, if the policy is attached, the Deny should work. Another possibility is that the user is assuming a role that has an allow, and the Deny is on a different policy that is not evaluated because the role's trust policy might allow the action. But the most likely reason in a troubleshooting scenario is that the policy contains a condition that is not being met, so the Deny is not applied. Option B is correct because if the Deny has a condition that is not satisfied, the Deny is not applied. Option A is wrong because the order of statements does not matter in IAM; all statements are evaluated. Option C is wrong because an explicit Deny always overrides an Allow. Option D is wrong because IAM policies support conditions.

Answer

The Deny statement is listed after an Allow statement in the policy

Answer

IAM policies do not support deny statements with conditions

Answer

The user has an attached AWS managed policy that allows the action

Question 9

A company has an S3 bucket with versioning enabled. They want to ensure that objects are not permanently deleted by users. What configuration should be applied?

Accepted Answer

Enable MFA Delete on the bucket. With versioning enabled, a delete request creates a delete marker instead of actually deleting the object. To prevent permanent deletion, you can enable MFA Delete, which requires multi-factor authentication to change the versioning state or permanently delete versions. Option C is correct. Option A is wrong because a bucket policy cannot prevent deletion of versioned objects; it can only deny the action, but users with delete permissions can still create delete markers. Option B is wrong because a lifecycle policy can delete objects after a period, but it does not prevent user deletions. Option D is wrong because S3 Object Lock prevents deletion during a retention period, but it is not specifically for preventing permanent deletion by users; it is for compliance.

Answer

Configure a lifecycle policy to expire noncurrent versions

Answer

Enable S3 Object Lock in governance mode

Answer

Add a bucket policy that denies s3:DeleteObject

Question 10

Refer to the exhibit. A SysOps administrator reviews the account password policy. Which of the following is true based on this output?

Accepted Answer

Users cannot reuse their last 5 passwords. The output shows MaxPasswordAge: 90 and ExpirePasswords: true, meaning passwords expire after 90 days. PasswordReusePrevention: 5 means users cannot reuse the last 5 passwords. Option B is correct. Option A is wrong because password expiration is enabled (ExpirePasswords: true). Option C is wrong because MaximumPasswordAge is 90 days. Option D is wrong because HardExpiry is false, meaning users can change expired passwords.

Answer

Passwords do not expire

Answer

The maximum password age is 120 days

Answer

Users cannot change expired passwords

Question 11

An S3 bucket policy is shown in the exhibit. The AdminRole attempts to upload an object to my-bucket without specifying any server-side encryption header. What will happen?

Accepted Answer

The upload fails because the Deny statement denies PutObject without encryption.. Option C is correct. The Deny statement denies PutObject when encryption is not aws:kms. Since the request has no encryption header, it does not equal aws:kms, so the Deny applies and the upload fails. The Allow statement allows the action only when encryption is aws:kms, so without encryption, it does not apply. Because the Deny overrides Allow, the upload is denied. Option A is wrong because the Allow does not apply. Option B is wrong because the Deny applies. Option D is wrong because the Deny does not depend on the Allow.

Answer

The upload fails because the Allow statement requires encryption, but the Deny statement is evaluated first.

Answer

The upload succeeds because the Allow statement grants permission to the AdminRole.

Answer

The upload succeeds because the Deny statement does not apply to the AdminRole.

Question 12

A company has an S3 bucket configured to log all access requests to another bucket. The security team notices that some delete requests are not being logged. What is the most likely cause?

Accepted Answer

The bucket has MFA Delete enabled, and the logging configuration does not capture MFA delete requests. S3 server access logs capture all requests that are made to a bucket, including delete requests. However, if the requester uses AWS Systems Manager or AWS CloudTrail to perform the deletion, it might not appear in S3 access logs if the logging bucket has a lifecycle policy that deletes logs before they are reviewed. But the most common reason for missing delete logs is that the requester used the S3 console with Multi-Factor Authentication (MFA) delete enabled, which requires additional authentication and might not be logged if the logging bucket itself has a policy that denies logging of MFA delete requests. However, the question asks for the most likely cause. Option C is correct because if MFA delete is enabled on the bucket, delete requests require MFA, and S3 server access logs might not capture these requests if the logging configuration does not support it. Option A is wrong because AWS CloudTrail logs API calls, including delete requests, but they would be in CloudTrail, not missing from S3 logs. Option B is wrong because S3 server access logs do capture delete requests. Option D is wrong because bucket policies do not prevent logging; they might deny access but the request would still be logged if denied.

Answer

The delete requests were made through AWS CloudTrail, which bypasses S3 access logging

Answer

The bucket policy denies logging of delete requests

Answer

S3 server access logs do not capture DELETE requests

Question 13

A company wants to centrally manage access to AWS accounts for its employees. Which AWS service should be used to create and manage users and groups across multiple accounts?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (successor to AWS SSO) allows you to create users and groups and assign them access to multiple AWS accounts with a single sign-on. Option B is correct. Option A is wrong because IAM is per-account, not cross-account. Option C is wrong because AWS Organizations manages accounts and policies, not users. Option D is wrong because AWS Directory Service is used for Microsoft Active Directory, not for cross-account access management.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS Organizations

Question 14

Refer to the exhibit. An IAM user has this policy attached. What is the effect when the user attempts to get an object from my-bucket from an IP address in the range 198.51.100.0/24?

Accepted Answer

Denied because the Deny statement applies. The policy has an Allow statement that grants s3:GetObject only from IP range 192.0.2.0/24. It also has a Deny statement that denies s3:GetObject from any IP not in that range (via NotIpAddress). Since the request comes from 198.51.100.0/24, which is not in the allowed range, the Deny statement applies and overrides any Allow. The request will be denied. Option C is correct. Option A is wrong because the Deny explicitly denies it. Option B is wrong because the Allow only applies to the specified range. Option D is wrong because the Deny is explicit.

Answer

Allowed because the Deny condition does not match

Answer

Denied because there is no explicit Allow for that IP range

Answer

Allowed because there is an Allow statement

Question 15

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. Which combination of services should the SysOps administrator use to meet this requirement?

Accepted Answer

A CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification. Option C is correct because CloudWatch Events (now Amazon EventBridge) can match CloudTrail events (like CreateAccessKey) and trigger an SNS notification. Option A is wrong because S3 events are not triggered by CloudTrail logs. Option B is wrong because Config rules evaluate resource configurations, not API calls. Option D is wrong because CloudWatch Logs Insights is a query tool, not an alerting mechanism.

Answer

CloudWatch Logs Insights query on CloudTrail logs with an alarm

Answer

An AWS Config rule that checks for new access keys and sends an SNS notification

Answer

S3 event notifications to an SNS topic

SOA-C02 Practice Test 49 — 15 Questions

Exhibit

SOA-C02 Practice Test 49 — 15 Questions

Exhibit