SOA-C02 Practice Test 50 — 15 Questions

Question 1

A CloudFormation template creates an S3 bucket with encryption and a bucket policy as shown in the exhibit. An administrator tries to upload an object using the AWS CLI without specifying any encryption. What will happen?

Accepted Answer

The upload fails because the bucket policy denies PutObject without the encryption header.. Option C is correct. The bucket policy denies PutObject if the encryption header is not AES256. Since the request has no encryption header, it does not equal AES256, so the Deny applies and the upload fails. The bucket's default encryption (AES256) applies only if the request does not specify encryption; however, the bucket policy is evaluated before the default encryption is applied, so the Deny takes effect. Option A is wrong because the policy denies it. Option B is wrong because default encryption does not satisfy the policy condition. Option D is wrong because the policy explicitly denies.

Answer

The upload succeeds because the bucket has default encryption enabled.

Answer

The upload fails because the bucket policy allows only objects with AES256 encryption, but the default encryption is sufficient.

Answer

The upload succeeds because the default encryption automatically adds the AES256 header.

Question 2

A company wants to ensure that all S3 buckets are encrypted by default. Which AWS service can be used to automatically enforce encryption on newly created S3 buckets?

Accepted Answer

AWS Config with a managed rule and auto-remediation. AWS Config can evaluate resources against rules and take remediation actions. Using a managed rule like 's3-bucket-server-side-encryption-enabled' and an auto-remediation action, AWS Config can automatically apply encryption to buckets that are non-compliant. Option B is correct. Option A is wrong because S3 does not have a bucket-level setting to enforce encryption by default; it must be configured per bucket. Option C is wrong because AWS CloudTrail logs API calls but does not enforce configurations. Option D is wrong because IAM policies can require encryption in requests but cannot automatically apply encryption to buckets.

Answer

S3 bucket policies

Answer

IAM policies

Answer

AWS CloudTrail

Question 3

Which TWO actions can be taken to secure an S3 bucket that contains sensitive data? (Choose two.)

Accepted Answer

Enable default encryption for the bucket. Blocking public access at the account level prevents any public access to buckets. Enabling default encryption ensures data is encrypted at rest. Option A and Option D are correct. Option B is wrong because versioning does not directly secure data; it protects against accidental deletion. Option C is wrong because enabling CloudTrail only logs access, it does not secure the bucket. Option E is wrong because adding a bucket policy that allows only HTTPS ensures encryption in transit, but it is not the most direct security measure.

Answer

Enable versioning on the bucket

Answer

Add a bucket policy that allows only HTTPS requests

Answer

Enable AWS CloudTrail for the bucket

Question 4

Refer to the exhibit. A SysOps administrator creates this stack. Which of the following is true about the bucket?

Accepted Answer

The bucket has versioning enabled. The template enables versioning and sets all public access block settings to true. This means the bucket is private and cannot be made public. Versioning is enabled. Option B is correct. Option A is wrong because public access is blocked. Option C is wrong because the bucket is not publicly accessible. Option D is wrong because versioning is enabled.

Answer

The bucket is publicly accessible

Answer

The bucket does not have versioning enabled

Answer

The bucket allows public read access

Question 5

Which THREE AWS services can be used to centrally manage and audit user permissions across multiple AWS accounts in AWS Organizations? (Choose THREE.)

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail logs API calls across accounts and can be aggregated. Option B is correct because AWS IAM Access Analyzer helps identify resources shared with external entities. Option D is correct because AWS Organizations provides a central view of accounts and SCPs. Option C is wrong because AWS Config is for resource compliance, not user permissions. Option E is wrong because AWS WAF is a web application firewall.

Answer

AWS WAF

Answer

AWS Config

Question 6

A SysOps administrator must grant an IAM user the ability to start and stop specific EC2 instances, but NOT terminate them. The administrator creates a policy with the following statement. However, the user can still terminate instances. What is the MOST likely reason?

Accepted Answer

The policy does not restrict the ec2:TerminateInstances action to specific instances using a condition or ARN. Option A is correct because EC2 actions like StopInstances and StartInstances require a resource-level permission on the instance, but TerminateInstances also requires a resource-level permission. The policy includes ec2:TerminateInstances with a condition, but if the condition is not met, the effect is Allow (since the condition is not satisfied, the statement might still allow termination if the condition is ignored). However, the key issue is that the policy uses ec2:ResourceTag as a condition key, which is valid, but the condition uses StringEquals, which requires the instance to have that tag. If the instance does not have the tag, the condition fails and the Allow does not apply, but there might be an implicit deny? Actually, the policy grants ec2:TerminateInstances with a condition that might not match, so the action is not allowed. But the user can still terminate, meaning the policy is too permissive. The most likely reason is that the policy allows ec2:TerminateInstances without proper resource restriction. Option B is incorrect because the condition key is correct. Option C is incorrect because termination is explicitly allowed with a condition. Option D is incorrect because the policy explicitly allows StartInstances and StopInstances.

Answer

The condition key ec2:ResourceTag is not a valid condition key for EC2 actions

Answer

The ec2:TerminateInstances action is not allowed in a customer-managed policy

Answer

The policy does not include an explicit deny for ec2:TerminateInstances

Question 7

A company has a VPC with a public and private subnet. The security team wants to restrict outbound traffic from EC2 instances in the private subnet to only allow traffic to an S3 bucket in the same account. Which of the following is the MOST secure way to achieve this?

Accepted Answer

Create a gateway VPC endpoint for S3, attach a bucket policy that allows access only from the VPC endpoint, and use a VPC endpoint policy to restrict actions to the specific bucket. Option D is correct because using a gateway VPC endpoint for S3 with a bucket policy that allows only the VPC's endpoint ID ensures that traffic can only come from within the VPC. Additionally, a VPC endpoint policy can restrict actions to the specific bucket. Option A is incorrect because NAT gateways allow all outbound traffic, not just to S3. Option B is incorrect because security groups cannot filter based on S3 bucket names. Option C is incorrect because an internet gateway would allow general outbound traffic.

Answer

Use an internet gateway and a route table that directs traffic to the internet gateway, and use network ACLs to allow only S3 IP ranges

Answer

Configure a NAT gateway in the public subnet and update the route table to send traffic to the NAT gateway, then use security groups to restrict outbound traffic

Answer

Use a VPC endpoint for S3 and attach a security group to the endpoint that allows only HTTPS traffic to the S3 prefix list

Question 8

A SysOps administrator needs to restrict access to an S3 bucket so that only users from the corporate network IP range (203.0.113.0/24) can read objects. Which TWO elements are required to implement this? (Choose two.)

Accepted Answer

The S3 endpoint URL (s3.amazonaws.com) accessible from the corporate network. Options A and B are correct. A bucket policy can use the aws:SourceIp condition to restrict access to the IP range. Additionally, if the users are accessing via the internet, they must use the S3 endpoint. Option C is incorrect because VPC endpoints are for private connectivity, but the condition would be different. Option D is incorrect because IAM policies are for user permissions, not IP restrictions. Option E is incorrect because CloudFront is a CDN, not required.

Answer

An IAM policy that allows s3:GetObject from the corporate IP

Answer

Amazon CloudFront distribution with an origin access identity

Answer

A VPC gateway endpoint for S3

Question 9

A SysOps administrator is investigating why an EC2 instance cannot access an S3 bucket using an IAM role. The instance has an associated IAM role with a policy that allows s3:GetObject on the bucket. The bucket policy also allows access from the role. However, the instance's application still gets access denied. What is the most likely cause?

Accepted Answer

The IAM role is not associated with the instance profile used by the EC2 instance. The instance profile must be correctly attached to the EC2 instance. Option C is correct because if the role is not properly associated with the instance profile, the instance will not have the necessary credentials. Option A is wrong because the S3 endpoint is not required for access via the internet. Option B is wrong because the bucket policy allows the role. Option D is wrong because the role already has the GetObject permission.

Answer

The IAM role does not have s3:ListBucket permission

Answer

The bucket policy explicitly denies access to the role

Answer

The S3 bucket is in a different region, requiring a VPC endpoint

Question 10

A company wants to use AWS KMS to encrypt data at rest for an S3 bucket. The security policy requires that the CMK be rotated every year. Which of the following are true about automatic key rotation for AWS KMS customer master keys (CMKs)? (Choose TWO.)

Accepted Answer

Automatic key rotation is supported for symmetric CMKs created in KMS. Automatic key rotation is supported only for symmetric CMKs created in KMS (option B). It is not supported for asymmetric CMKs (option A) or imported keys (option C). Option D is wrong because rotation creates new backing keys but does not delete old ones. Option E is wrong because rotation is not automatic for imported keys.

Answer

Automatic key rotation is supported for asymmetric CMKs

Answer

Automatic key rotation can be enabled for any CMK at any time

Answer

Automatic key rotation is supported for imported CMKs

Answer

When a CMK is rotated, the previous backing key is deleted

Question 11

Refer to the exhibit. An IAM policy is attached to a user. What is the effective permission regarding the s3:DeleteObject action on the example-bucket?

Accepted Answer

Denied because of the explicit Deny statement. In IAM, an explicit Deny overrides any Allow. So even though the first statement allows all S3 actions, the second statement explicitly denies DeleteObject. Thus DeleteObject is denied. Option B is correct. Options A, C, D are incorrect because Deny prevails.

Answer

Denied because the action is not allowed explicitly

Answer

Allowed because the Allow statement is listed first

Answer

Allowed because the Deny statement has a typo

Question 12

A company wants to allow an external auditor to assume an IAM role in their AWS account to review resources. What is the minimum information the auditor needs from the company to do this?

Accepted Answer

The Amazon Resource Name (ARN) of the IAM role to assume.. Option C is correct because the auditor needs the role ARN to assume the role. Option A is wrong because the IAM user name is for direct access, not role assumption. Option B is wrong because the account ID alone is insufficient. Option D is wrong because the IAM policy is not needed; the auditor's account must have permissions.

Answer

The IAM user name and password of the company's admin user.

Answer

The IAM policy document that grants the auditor access.

Answer

The AWS account ID and the region where resources are hosted.

Question 13

A company's security team requires that all API calls to AWS services are encrypted in transit using TLS 1.2 or higher. Which TWO actions should be taken to enforce this?

Accepted Answer

Use AWS CloudTrail to monitor for API calls using TLS 1.0 and generate alerts.. Option A and Option E are correct. Using an SCP that denies requests without TLS 1.2 and using CloudTrail to monitor for non-compliant requests are effective. Option B is wrong because IAM policies cannot enforce protocol versions. Option C is wrong because enforcing HTTPS only is not enough; TLS version matters. Option D is wrong because EC2 security groups control network traffic, not API calls.

Answer

Enable AWS CloudTrail to log all API calls.

Answer

Configure EC2 security groups to only allow HTTPS traffic.

Answer

Create an IAM policy that denies access unless the request uses TLS 1.2.

Question 14

A company uses AWS KMS to encrypt EBS volumes attached to EC2 instances. The security team wants to ensure that only specific IAM roles can decrypt the volumes. Which configuration meets this requirement?

Accepted Answer

Modify the KMS key policy to allow only specific IAM roles to use kms:Decrypt.. Option D is correct because a key policy in KMS can define which IAM roles can use the key for decryption. Option A is wrong because instance profiles do not control decrypt permissions. Option B is wrong because bucket policies are for S3, not EBS. Option C is wrong because SCPs can restrict but are not granular for specific roles.

Answer

Use a service control policy to deny kms:Decrypt for all users.

Answer

Apply a bucket policy on the EBS snapshot bucket.

Answer

Attach an instance profile with a policy that denies ec2:DetachVolume.

Question 15

A company needs to restrict access to an S3 bucket so that only users from a specific VPC can read objects. Which THREE configurations are required?

Accepted Answer

Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.. Options A, B, and D are correct. A bucket policy with a condition for vpc:SourceVpce, a VPC endpoint for S3, and the route table updates are required. Option C is wrong because S3 does not require a security group for VPC endpoints; network ACLs are not needed. Option E is wrong because IAM users alone do not restrict by VPC.

Answer

Create IAM users and assign them permissions to access the bucket.

Answer

Attach a security group to the S3 bucket.

SOA-C02 Practice Test 50 — 15 Questions

Exhibit

SOA-C02 Practice Test 50 — 15 Questions

Exhibit