SOA-C02 Mock Exam 74 — 25 Questions

Question 1

The CISO asks for a centralized dashboard showing security findings from GuardDuty, Macie, Inspector, and Firewall Manager across 30 AWS accounts. Findings must be normalized into a single format so they can be prioritized by severity without switching between services. Which AWS service provides this capability?

Accepted Answer

Enable AWS Security Hub with an administrator account in the organization; integrate GuardDuty, Macie, Inspector, and Firewall Manager as finding providers. AWS Security Hub is designed to aggregate, normalize, and prioritize security findings from multiple AWS services (GuardDuty, Macie, Inspector, Firewall Manager) and third-party tools across accounts. By designating an administrator account in AWS Organizations, you can centrally view all findings in a single dashboard, with a standardized findings format (AWS Security Finding Format, ASFF) that includes severity, resource, and remediation fields. This directly meets the CISO's requirement for a centralized, normalized, severity-prioritized view without switching between services.

Answer

Deploy a custom Lambda function that polls each service's API and writes findings to a DynamoDB table for a custom dashboard

Answer

Enable Amazon Detective to investigate and correlate security findings across all accounts

Answer

Configure AWS Config conformance packs to evaluate security compliance checks across all accounts and report to an aggregator account

Question 2

A company's security policy requires that all Amazon EC2 instances must have a specific tag 'Environment' with a value of either 'Production' or 'Development'. The SysOps administrator needs to detect any instance that is missing this tag or has an invalid value, and automatically email the operations team. Which AWS service should be used to achieve this with the least operational overhead?

Accepted Answer

AWS Config with the 'required-tags' managed rule and Amazon SNS. AWS Config's 'required-tags' managed rule continuously evaluates EC2 instances against the specified tag key and allowed values, triggering an SNS notification when non-compliant resources are detected. This provides automated detection and alerting with minimal operational overhead, as it requires no custom code or infrastructure management.

Answer

Amazon CloudWatch Events with an EC2 instance state change rule and AWS Lambda

Answer

AWS Trusted Advisor with a custom check

Answer

Amazon Inspector with a network assessment

Question 3

A company's security policy requires that all IAM users must change their passwords every 90 days. The SysOps administrator needs to enforce this requirement. Which IAM setting should the administrator configure?

Accepted Answer

IAM password policy. The IAM password policy is the correct setting because it allows the SysOps administrator to define password rotation requirements, such as a mandatory password change every 90 days. This policy is applied at the account level and enforces the security requirement for all IAM users, ensuring compliance without needing to modify individual user permissions.

Answer

IAM user permissions boundary

Answer

IAM role trust policy

Answer

IAM group policy

Question 4

A company stores database credentials in AWS Secrets Manager. The security policy requires that the credentials be rotated automatically every 30 days. Which action should the SysOps administrator take to enforce this requirement?

Accepted Answer

Enable automatic rotation in the Secrets Manager console and specify a rotation interval of 30 days using a Lambda rotation function.. Option B is correct because AWS Secrets Manager natively supports automatic rotation using a Lambda function. By enabling automatic rotation in the console and specifying a 30-day interval, the administrator meets the security policy without manual intervention. Secrets Manager handles the rotation schedule and invokes the Lambda function automatically.

Answer

Configure an AWS Lambda function to rotate the secret and set a CloudWatch Events rule to trigger it every 30 days.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and configure a State Manager association for rotation.

Answer

Create an IAM policy that forces users to rotate the secret manually every 30 days.

Question 5

Drag and drop the steps to configure an Amazon Route 53 failover routing policy into the correct order.

Question 6

Match each AWS service with its primary security compliance function. (Drag each service to its correct function.) (Choose 4.)

Accepted Answer

AWS CloudTrail -> Detect unauthorized API calls. AWS CloudTrail is the service that records API activity in your AWS account, including both management and data events. By enabling CloudTrail, you can detect unauthorized API calls by analyzing the recorded events for actions that were not initiated by authorized users or services, such as an IAM user making a call from an unexpected IP address or using an unknown user agent.

Question 7

A company requires that all users in an AWS account must authenticate with multi-factor authentication (MFA) before they can perform any actions on Amazon EC2 instances. The SysOps administrator needs to implement this requirement using IAM policies. Which IAM policy condition key should be used to enforce MFA?

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key checks whether the user authenticated using a valid MFA device before making the API request. By setting this condition to `true` in an IAM policy, you can enforce that all actions on EC2 instances require MFA authentication, meeting the company's requirement.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

iam:PassedToService

Question 8

A company operates a web application behind an Application Load Balancer (ALB). The SysOps administrator needs to block incoming requests from specific geographic locations (countries X and Y) and also enforce a rate limit of 100 requests per IP address per 5-minute window to mitigate DDoS attacks. The solution must be centrally configured and apply to all requests handled by the ALB. Which AWS service should be used to implement these requirements?

Accepted Answer

AWS WAF. AWS WAF is the correct service because it provides both geographic (geo-match) blocking and rate-based rules that can be associated directly with an Application Load Balancer. Geo-match conditions allow you to block requests from specific countries (X and Y), while rate-based rules can limit requests to 100 per 5-minute window per source IP. This solution is centrally configured at the ALB level, applying to all incoming requests without requiring additional infrastructure.

Answer

Amazon CloudFront geo restriction

Answer

AWS Shield Advanced

Answer

Security Groups

Question 9

A company manages multiple AWS accounts under AWS Organizations. The security team requires that all Amazon S3 buckets in the organization must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect any bucket that is not compliant and remediate it by enabling SSE-KMS. Which AWS feature or service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config with the s3-bucket-server-side-encryption-enabled managed rule and automatic remediation using an AWS Systems Manager Automation document.. AWS Config's `s3-bucket-server-side-encryption-enabled` managed rule can evaluate S3 buckets for encryption compliance. When a non-compliant bucket is detected, AWS Config can trigger automatic remediation via an AWS Systems Manager Automation document that applies SSE-KMS encryption to the bucket. This provides a fully automated, policy-driven enforcement mechanism without manual intervention.

Answer

AWS CloudTrail to log bucket creation events and trigger an AWS Lambda function that applies SSE-KMS.

Answer

Amazon Inspector to scan S3 buckets for encryption compliance and automatically apply SSE-KMS.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications but not auto-remediate.

Question 10

A company's security policy requires that all Amazon S3 buckets must be encrypted at rest with AWS Key Management Service (AWS KMS) customer managed keys. A SysOps administrator discovers that some buckets are not encrypted. Which combination of AWS services should be used to automatically detect and remediate non-compliant buckets using infrastructure as code?

Accepted Answer

AWS Config with a managed rule and AWS Lambda for automatic remediation.. AWS Config with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) can continuously evaluate S3 buckets for compliance with the encryption policy. When a non-compliant bucket is detected, AWS Config can automatically invoke an AWS Lambda function to remediate the issue, such as enabling encryption with a customer managed KMS key. This combination provides automated detection and remediation using infrastructure as code, as the Config rule and Lambda function can be defined in AWS CloudFormation or similar IaC tools.

Answer

AWS CloudTrail and Amazon GuardDuty.

Answer

Amazon Inspector and AWS Systems Manager.

Answer

Amazon Macie and AWS CloudFormation.

Question 11

A company's security policy requires that only traffic from the corporate office IP range (203.0.113.0/24) can access an Amazon S3 bucket that stores internal reports. The SysOps administrator must enforce this restriction. Which policy type should be modified to implement this requirement?

Accepted Answer

S3 bucket policy. An S3 bucket policy is the correct choice because it allows you to explicitly deny or allow access to the S3 bucket based on the source IP address using the `aws:SourceIp` condition key. This policy is attached directly to the bucket and can restrict access to only the corporate office IP range (203.0.113.0/24), regardless of the IAM user or role making the request. It enforces the security requirement at the resource level, which is the most direct and effective method for controlling network-based access to an S3 bucket.

Answer

IAM identity-based policy

Answer

VPC endpoint policy

Answer

AWS Organizations SCP

Question 12

A company's security team requires that all Amazon S3 buckets are encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). A SysOps administrator needs to automatically detect any S3 bucket that does not have encryption enabled and automatically apply SSE-S3 encryption. The solution should leverage AWS managed services and minimize custom code. Which combination of AWS services should be used?

Accepted Answer

Use AWS Config managed rule 's3-bucket-server-side-encryption-enabled' with an automatic remediation action using AWS Systems Manager Automation.. Option B is correct because AWS Config's managed rule 's3-bucket-server-side-encryption-enabled' continuously evaluates S3 buckets for encryption compliance, and its automatic remediation action can invoke an AWS Systems Manager Automation document to enable SSE-S3 encryption on noncompliant buckets without custom code. This fully meets the requirement to automatically detect and remediate unencrypted buckets using AWS managed services.

Answer

Use AWS Trusted Advisor to identify unencrypted buckets and then manually enable encryption.

Answer

Use AWS CloudTrail to detect PutBucket operations and trigger a Lambda function that enables encryption.

Answer

Create an IAM bucket policy that denies any PutObject request that does not include x-amz-server-side-encryption header.

Question 13

A company's security team requires that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. The SysOps administrator needs to create an IAM policy that denies all console actions if the user has not authenticated with MFA. Which IAM condition key should the administrator use?

Accepted Answer

aws:MultiFactorAuthPresent. Option A is correct because the `aws:MultiFactorAuthPresent` condition key evaluates to `true` when the user has authenticated using MFA. By using this key in a `Deny` statement, the policy can block all console actions unless MFA is present, enforcing the security team's requirement.

Answer

aws:SourceIp

Answer

iam:PassedToService

Answer

aws:RequestedRegion

Question 14

A company's security policy requires that the AWS account root user must have multi-factor authentication (MFA) enabled. A SysOps administrator needs to continuously verify compliance and automatically notify the security team if the root user is not configured with MFA. Which AWS service can be used to create a compliance rule for this requirement?

Accepted Answer

AWS Config with the managed rule 'root-account-mfa-enabled'. AWS Config provides a managed rule called 'root-account-mfa-enabled' that continuously evaluates whether the root user has an MFA device configured. When the rule detects non-compliance, it can trigger an Amazon SNS notification to alert the security team, meeting the requirement for automated compliance verification and alerting.

Answer

AWS Trusted Advisor

Answer

AWS Identity and Access Management (IAM) Access Analyzer

Answer

Amazon Inspector

Question 15

A company's security policy requires that all IAM users must authenticate using multi-factor authentication (MFA) before accessing the Amazon S3 bucket containing confidential finance data. The SysOps administrator needs to create an IAM policy that denies access to the S3 bucket if the user has not authenticated using MFA. Which IAM condition key should the administrator include in the policy?

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key evaluates to `true` when the requesting IAM user has authenticated using a valid MFA device. By including this key in a `Deny` statement with a condition that it is `false`, the policy effectively blocks any S3 access unless MFA was used. This directly enforces the security policy requirement.

Answer

aws:UserAgent

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Question 16

A company wants to enforce that all Amazon EC2 instances launched in the AWS account must have a specific termination protection setting enabled. The SysOps administrator needs to automatically remediate any instances that are launched without termination protection. Which AWS service should be used to achieve this?

Accepted Answer

AWS Config with a custom rule using AWS Lambda to evaluate and enable termination protection.. AWS Config can evaluate resources against desired configurations using managed or custom rules. A custom AWS Config rule can invoke a Lambda function to check if termination protection is enabled on EC2 instances and automatically enable it if missing, providing the required remediation. This approach directly addresses the requirement to enforce termination protection on all launched instances.

Answer

AWS Config with a managed rule ec2-instance-no-public-ip and an SSM Automation remediation.

Answer

Amazon Inspector to scan instances and trigger a remediation action.

Answer

AWS Systems Manager Patch Manager to apply a policy for termination protection.

Question 17

A company's security policy requires that all IAM user passwords must be at least 12 characters long. The SysOps administrator needs to enforce this requirement across the AWS account. Which action should the administrator take?

Accepted Answer

Update the IAM account password policy to require a minimum length of 12 characters.. The IAM account password policy is the native AWS mechanism for enforcing password requirements across all IAM users in an account. By updating this policy to require a minimum length of 12 characters, the administrator ensures that any new or changed password must comply, and existing passwords are not affected until the next change. This is a direct, account-wide setting that requires no additional services or custom logic.

Answer

Create an AWS Config rule to check password length and auto-remediate.

Answer

Enable AWS CloudTrail to monitor for password changes and alert the administrator.

Answer

Attach a service control policy (SCP) that denies IAM user creation if the password is less than 12 characters.

Question 18

A SysOps administrator needs to ensure that all traffic to an Application Load Balancer (ALB) uses encryption. How can this be enforced?

Accepted Answer

Create a listener that redirects HTTP requests (port 80) to HTTPS (port 443).. Option B is correct because an Application Load Balancer can be configured with a listener rule that redirects incoming HTTP (port 80) requests to HTTPS (port 443). This ensures that all traffic to the ALB is encrypted in transit, as any unencrypted HTTP request is automatically redirected to the secure HTTPS protocol. The redirect action is a native ALB feature and does not require additional services or complex configurations.

Answer

Configure the security group to allow only HTTPS traffic (port 443).

Answer

Use AWS WAF to block HTTP requests.

Answer

Configure the ALB to use a custom SSL certificate.

Question 19

An organization requires that all Amazon S3 buckets block public access entirely. A SysOps administrator needs to ensure that no bucket can be made public, even accidentally. Which approach enforces this control at the organizational level?

Accepted Answer

Enable S3 Block Public Access at the account level and attach an SCP to deny changes to it.. Option C is correct because S3 Block Public Access at the account level provides a centralized, immutable control that prevents any bucket in the account from being made public, regardless of bucket policies or ACLs. Attaching an SCP (Service Control Policy) to deny changes to these settings ensures that even administrators with full IAM permissions cannot disable the block, enforcing the control at the organizational level across all accounts in the organization.

Answer

Apply an S3 Bucket Policy on each bucket that denies public access.

Answer

Use an AWS Config managed rule 's3-bucket-public-read-prohibited' to detect and remediate public buckets.

Answer

Create an IAM policy that denies s3:PutBucketPolicy for all users.

Question 20

An organization requires that all Amazon S3 buckets be encrypted at rest by default. A SysOps administrator needs to enforce this using AWS Config. Which AWS Config managed rule should be used?

Accepted Answer

s3-bucket-encryption-enabled. The AWS Config managed rule `s3-bucket-encryption-enabled` checks whether S3 buckets have default encryption enabled (SSE-S3, SSE-KMS, or SSE-C). This directly enforces the requirement that all buckets are encrypted at rest by default, as it evaluates each bucket's encryption configuration and flags non-compliant resources.

Answer

s3-bucket-ssl-requests-only

Answer

s3-bucket-public-read-prohibited

Answer

s3-bucket-logging-enabled