SOA-C02 Practice Exam 69 — 20 Questions

Question 1

A company uses AWS Organizations with multiple member accounts. The SysOps administrator needs to deploy a common AWS CloudFormation template that creates an IAM role across all member accounts in the organization. Which AWS service should be used to deploy this template across accounts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudFormation StackSets. AWS CloudFormation StackSets is the correct service because it extends CloudFormation functionality to deploy templates across multiple accounts and regions from a single management account. StackSets uses a self-managed or service-managed permission model, and with AWS Organizations, it can automatically deploy to all member accounts in the organization or specified organizational units (OUs), making it ideal for deploying a common IAM role across all accounts.

Answer

AWS CodePipeline with cross-account deployment actions

Answer

AWS CloudFormation cross-stack references

Answer

AWS Service Catalog

Question 2

An organization requires that all Amazon S3 buckets be encrypted at rest by default. A SysOps administrator needs to enforce this using AWS Config. Which AWS Config managed rule should be used?

Accepted Answer

s3-bucket-encryption-enabled. The AWS Config managed rule `s3-bucket-encryption-enabled` checks whether S3 buckets have default encryption enabled (SSE-S3, SSE-KMS, or SSE-C). This directly enforces the requirement that all buckets are encrypted at rest by default, as it evaluates each bucket's encryption configuration and flags non-compliant resources.

Answer

s3-bucket-ssl-requests-only

Answer

s3-bucket-public-read-prohibited

Answer

s3-bucket-logging-enabled

Question 3

A company's security policy requires that all Amazon S3 buckets must be encrypted at rest with AWS Key Management Service (AWS KMS) customer managed keys. A SysOps administrator discovers that some buckets are not encrypted. Which combination of AWS services should be used to automatically detect and remediate non-compliant buckets using infrastructure as code?

Accepted Answer

AWS Config with a managed rule and AWS Lambda for automatic remediation.. AWS Config with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) can continuously evaluate S3 buckets for compliance with the encryption policy. When a non-compliant bucket is detected, AWS Config can automatically invoke an AWS Lambda function to remediate the issue, such as enabling encryption with a customer managed KMS key. This combination provides automated detection and remediation using infrastructure as code, as the Config rule and Lambda function can be defined in AWS CloudFormation or similar IaC tools.

Answer

AWS CloudTrail and Amazon GuardDuty.

Answer

Amazon Inspector and AWS Systems Manager.

Answer

Amazon Macie and AWS CloudFormation.

Question 4

A company operates a web application behind an Application Load Balancer (ALB). The SysOps administrator needs to block incoming requests from specific geographic locations (countries X and Y) and also enforce a rate limit of 100 requests per IP address per 5-minute window to mitigate DDoS attacks. The solution must be centrally configured and apply to all requests handled by the ALB. Which AWS service should be used to implement these requirements?

Accepted Answer

AWS WAF. AWS WAF is the correct service because it provides both geographic (geo-match) blocking and rate-based rules that can be associated directly with an Application Load Balancer. Geo-match conditions allow you to block requests from specific countries (X and Y), while rate-based rules can limit requests to 100 per 5-minute window per source IP. This solution is centrally configured at the ALB level, applying to all incoming requests without requiring additional infrastructure.

Answer

Amazon CloudFront geo restriction

Answer

AWS Shield Advanced

Answer

Security Groups

Question 5

An application uses an Amazon DynamoDB table with on-demand capacity. The SysOps administrator needs to ensure the table remains available during an AWS regional outage. Which strategy should be used?

Accepted Answer

Use DynamoDB global tables.. DynamoDB global tables provide multi-region, multi-active replication, ensuring the table remains available during an AWS regional outage by automatically replicating data across selected AWS Regions. This is the only option that addresses regional fault tolerance by design, as it uses DynamoDB's built-in replication to maintain availability and data durability across regions.

Answer

Enable DynamoDB Accelerator (DAX).

Answer

Create a read replica in another region.

Answer

Increase read and write capacity units.

Question 6

A company manages multiple AWS accounts under AWS Organizations. The security team requires that all Amazon S3 buckets in the organization must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect any bucket that is not compliant and remediate it by enabling SSE-KMS. Which AWS feature or service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config with the s3-bucket-server-side-encryption-enabled managed rule and automatic remediation using an AWS Systems Manager Automation document.. AWS Config's `s3-bucket-server-side-encryption-enabled` managed rule can evaluate S3 buckets for encryption compliance. When a non-compliant bucket is detected, AWS Config can trigger automatic remediation via an AWS Systems Manager Automation document that applies SSE-KMS encryption to the bucket. This provides a fully automated, policy-driven enforcement mechanism without manual intervention.

Answer

AWS CloudTrail to log bucket creation events and trigger an AWS Lambda function that applies SSE-KMS.

Answer

Amazon Inspector to scan S3 buckets for encryption compliance and automatically apply SSE-KMS.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications but not auto-remediate.

Question 7

The CISO asks for a centralized dashboard showing security findings from GuardDuty, Macie, Inspector, and Firewall Manager across 30 AWS accounts. Findings must be normalized into a single format so they can be prioritized by severity without switching between services. Which AWS service provides this capability?

Accepted Answer

Enable AWS Security Hub with an administrator account in the organization; integrate GuardDuty, Macie, Inspector, and Firewall Manager as finding providers. AWS Security Hub is designed to aggregate, normalize, and prioritize security findings from multiple AWS services (GuardDuty, Macie, Inspector, Firewall Manager) and third-party tools across accounts. By designating an administrator account in AWS Organizations, you can centrally view all findings in a single dashboard, with a standardized findings format (AWS Security Finding Format, ASFF) that includes severity, resource, and remediation fields. This directly meets the CISO's requirement for a centralized, normalized, severity-prioritized view without switching between services.

Answer

Deploy a custom Lambda function that polls each service's API and writes findings to a DynamoDB table for a custom dashboard

Answer

Enable Amazon Detective to investigate and correlate security findings across all accounts

Answer

Configure AWS Config conformance packs to evaluate security compliance checks across all accounts and report to an aggregator account

Question 8

A company's security policy requires that all Amazon S3 buckets must be non-publicly accessible. The SysOps administrator needs to automatically detect any bucket that becomes publicly accessible and automatically remediate it by applying a bucket policy that blocks public access. The solution should use AWS managed services with minimal custom code. Which combination of services should be used?

Accepted Answer

AWS Config with managed rule and automatic remediation via SSM Automation. AWS Config with a managed rule (e.g., s3-bucket-public-read-prohibited or s3-bucket-public-write-prohibited) can continuously evaluate S3 bucket configurations against the security policy. When a bucket becomes publicly accessible, AWS Config triggers an automatic remediation action using an SSM Automation document that applies a bucket policy to block public access, all without custom code.

Answer

AWS IAM Access Analyzer with Amazon EventBridge

Answer

AWS CloudTrail and AWS Lambda

Answer

AWS Trusted Advisor and Amazon SNS

Question 9

A company's security team requires that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. The SysOps administrator needs to create an IAM policy that denies all console actions if the user has not authenticated with MFA. Which IAM condition key should the administrator use?

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key evaluates to `true` when the user has authenticated using MFA. By using this key in a `Deny` statement, the policy can block all console actions unless MFA is present, enforcing the security team's requirement.

Answer

aws:SourceIp

Answer

iam:PassedToService

Answer

aws:RequestedRegion

Question 10

A company has a CloudFront distribution with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible through CloudFront. Which configuration is required to ensure that direct access to the S3 bucket is blocked?

Accepted Answer

Create an Origin Access Identity (OAI) and add a bucket policy that grants access only to the OAI. The correct configuration is to create an Origin Access Identity (OAI) and grant it access via the S3 bucket policy. An OAI is a special CloudFront user that can be associated with a distribution. By updating the S3 bucket policy to allow only the OAI to perform s3:GetObject, you ensure that objects are only accessible through CloudFront. This effectively blocks direct public access to the bucket while allowing CloudFront to serve the content.

Answer

Attach an IAM role to CloudFront that allows S3 access

Answer

Set the S3 bucket policy to deny all access except from CloudFront's IP ranges

Answer

Use signed URLs for all requests

Question 11

A company's security policy requires that all Amazon RDS for PostgreSQL instances be encrypted at rest using AWS Key Management Service (KMS) customer managed keys and have automated backups enabled with a retention period of at least 30 days. A SysOps administrator needs to use AWS Config to automatically detect any RDS instance that is non-compliant with either requirement and automatically remediate it. Which combination of AWS Config managed rules and remediation actions should be used?

Accepted Answer

Use the AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure automatic remediation for each rule using the corresponding AWS Systems Manager Automation runbook: 'AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup'.. AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled' natively evaluate encryption and backup compliance. The corresponding AWS Systems Manager Automation runbooks ('AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup') provide built-in, automatic remediation without custom code, aligning with the requirement to use managed rules and automatic remediation.

Answer

Use two AWS Config managed rules: 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure each rule with an automatic remediation action that triggers an Amazon CloudWatch alarm, which then invokes an AWS Lambda function to enable encryption and backups.

Answer

Create custom AWS Config rules as AWS Lambda functions that evaluate the RDS instance configuration. In the Lambda function, if a resource is non-compliant, call the RDS API to enable encryption and modify backup settings.

Answer

Use a single custom AWS Config rule that checks both encryption and backup settings. If non-compliant, trigger an AWS Lambda function that uses the RDS API to configure both settings.

Question 12

A company runs a batch processing job on Amazon EC2 that runs for 2 hours every night. The job can tolerate interruptions and can resume from the last checkpoint. The SysOps administrator needs to minimize compute costs. Which EC2 purchasing option should be used?

Accepted Answer

Spot Instances. Spot Instances are ideal for fault-tolerant, interruptible workloads like this batch processing job because they offer significant cost savings (up to 90% off On-Demand prices) in exchange for being reclaimable by AWS with a 2-minute warning. Since the job can resume from the last checkpoint, interruptions do not cause data loss or restart from scratch, making Spot Instances the most cost-effective choice.

Answer

On-Demand Instances

Answer

Reserved Instances

Answer

Compute Savings Plans

Question 13

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer (ALB) in the public subnets routes traffic to EC2 instances in the private subnets. The EC2 instances need to access the internet for software updates. Which solution is MOST secure and cost-effective?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet route tables pointing 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing inbound connections from the internet. This is the most secure and cost-effective solution because it uses a managed AWS service that scales automatically and incurs charges only for usage and hourly uptime, avoiding the need for a bastion host or VPN.

Answer

Set up a VPN connection to an on-premises network and route internet traffic through it.

Answer

Assign public IP addresses to the EC2 instances and route traffic directly.

Answer

Attach an internet gateway to the private subnets and route 0.0.0.0/0 to it.

Question 14

A company is running a critical web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across two Availability Zones. The company needs to ensure that if an entire Availability Zone fails, the application remains available. Which configuration meets this requirement?

Accepted Answer

Configure the Auto Scaling group to launch instances in at least two Availability Zones.. Configuring the Auto Scaling group to launch instances in at least two Availability Zones ensures that if one AZ fails, the remaining AZ(s) continue to serve traffic. The Application Load Balancer automatically distributes incoming requests across healthy instances in all configured AZs, and the Auto Scaling group replaces failed instances in the remaining AZs, maintaining capacity. This design provides high availability without relying on a single AZ, which would be a single point of failure.

Answer

Use larger EC2 instance types to handle the load during a failure.

Answer

Use Amazon CloudFront to distribute traffic across multiple regions.

Answer

Launch all instances in the same Availability Zone to reduce latency.

Question 15

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot be accessed via SSH from the internet. The security group allows inbound SSH (port 22) from 0.0.0.0/0. The network ACL (NACL) for the subnet has an inbound rule allowing SSH from 0.0.0.0/0. What else could be blocking access?

Accepted Answer

The NACL outbound rule is blocking return traffic.. Network ACLs are stateless, meaning they evaluate inbound and outbound traffic separately. Even if the inbound rule allows SSH, the outbound rule must also allow the return traffic (ephemeral ports) for the SSH session to work. If the NACL outbound rule is blocking return traffic, the SSH connection will fail.

Answer

The NACL inbound rule is blocking traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The security group rule is misconfigured.

Question 16

A SysOps administrator is configuring Amazon CloudFront to serve content from an Amazon S3 bucket. The content is sensitive and should be encrypted at rest. Which option ensures that content is encrypted at rest in S3?

Accepted Answer

Enable server-side encryption (SSE-S3) on the S3 bucket. Enabling server-side encryption (SSE-S3) on the S3 bucket ensures that objects are encrypted at rest using AES-256 encryption managed by Amazon S3. This directly addresses the requirement for content to be encrypted while stored in S3, independent of how CloudFront accesses the bucket.

Answer

Enable CloudFront HTTPS-only access to the S3 bucket

Answer

Configure signed URLs for the distribution

Answer

Use CloudFront field-level encryption

Question 17

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The SysOps administrator notices that the DB instance's CPU utilization spikes to 100% every few minutes. CloudWatch alarms have been set to trigger when CPU exceeds 90% for 5 minutes, but no alarm state changes are observed. The administrator checks the CloudWatch metrics and sees that the CPU utilization metric shows periodic spikes but they last only 2-3 minutes each. What is the most likely cause and what should the administrator do to receive notifications?

Accepted Answer

Set the alarm to evaluate over 1 minute instead of 5 minutes.. The CPU utilization spikes last only 2-3 minutes, which is shorter than the alarm's evaluation period of 5 consecutive minutes. Since the alarm requires the metric to exceed the 90% threshold for 5 minutes before triggering, these brief spikes never satisfy the alarm's duration condition. Setting the alarm to evaluate over 1 minute will match the spike duration and allow the alarm to trigger on these short-lived bursts.

Answer

The Multi-AZ failover is causing the spikes; disable Multi-AZ.

Answer

The DB instance is not publishing CPU metrics at a high enough resolution.

Answer

The CPU metric is not accurate; use the CPU credit metric instead.

Question 18

Account A owns an S3 bucket containing shared artifacts. Account B needs to read objects from the bucket. The Account A team wants to grant access without creating IAM users, sharing access keys, or creating a role in Account A that Account B assumes. How should the bucket be configured to allow Account B's IAM roles to read objects?

Accepted Answer

Add an S3 bucket policy on Account A's bucket with Principal set to Account B's account ID and s3:GetObject permission; ensure Account B's roles have s3:GetObject in their identity policies. It uses an S3 bucket policy with a Principal set to Account B's account ID, which grants cross-account access to all IAM principals (users and roles) in Account B. Account B's IAM roles must also have an identity policy that allows s3:GetObject, ensuring that the effective permissions require both the bucket policy and the role's policy to allow the action. This approach avoids creating IAM users, sharing access keys, or setting up a role in Account A for Account B to assume.

Answer

Create an IAM role in Account A with s3:GetObject permission and a trust policy allowing Account B's roles to assume it

Answer

Generate a presigned URL for each object in Account A and share the URLs with Account B's services

Answer

Enable S3 Access Points on the bucket and create an access point that allows Account B's VPC to connect via PrivateLink

Question 19

A SysOps administrator configures AWS CloudTrail to log all management events in a company's AWS account. The administrator needs to ensure that CloudTrail logs are not deleted for at least 5 years to meet compliance requirements. Which configuration should the administrator apply?

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket.. S3 Object Lock provides a Write-Once-Read-Many (WORM) model that prevents objects from being deleted or overwritten for a specified retention period. By enabling S3 Object Lock on the CloudTrail S3 bucket and setting a retention mode (e.g., Compliance or Governance) with a 5-year retention period, the administrator ensures that CloudTrail log files cannot be deleted, meeting the compliance requirement.

Answer

Enable CloudTrail log file validation.

Answer

Enable CloudTrail data events for S3.

Answer

Apply an S3 bucket policy that prohibits deletion of log files.

Question 20

A company runs a critical application on EC2 instances in an Auto Scaling group. The application processes messages from an Amazon SQS queue. The SysOps administrator notices that during periods of high load, the SQS queue depth increases significantly, and the application takes a long time to recover. The administrator wants to improve the application's ability to handle spikes in traffic without over-provisioning resources. The application is stateless and can scale horizontally. What should the administrator do?

Accepted Answer

Configure an auto scaling policy for the Auto Scaling group based on the SQS queue depth (ApproximateNumberOfMessagesVisible).. Scaling on the SQS queue depth (ApproximateNumberOfMessagesVisible) directly ties Auto Scaling capacity to the backlog, so the group adds instances when messages accumulate and removes them when the queue drains. This is the canonical target-tracking or step-scaling pattern for queue-driven, stateless workloads and avoids over-provisioning during normal load.

Answer

Change the SQS queue from standard to FIFO to ensure messages are processed in order.

Answer

Use a larger EC2 instance type with enhanced networking to process messages faster.

Answer

Increase the EC2 instance size to a larger type with more CPU and memory.