SOA-C02 Security and Compliance — 50 Questions

Question 1

An organization requires that all Amazon EC2 instances must be launched only with approved Amazon Machine Images (AMIs) that have been pre-approved by the security team. The SysOps administrator needs to enforce this policy for all current and future instances in the AWS account. Unapproved AMIs should be prevented from launching. Which solution meets these requirements with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an AWS Service Control Policy (SCP) to deny ec2:RunInstances if the AMI ID is not in an approved list.. An AWS Service Control Policy (SCP) can deny the ec2:RunInstances action if the AMI ID is not in an approved list. This prevents any user or role in the account from launching instances with unapproved AMIs, even if the user has full administrative permissions. SCPs operate at the organization level and require no per-user or per-role configuration, offering minimal operational overhead. In contrast, AWS Config's 'approved-amis-by-id' rule only detects noncompliant instances after launch; automatic remediation (e.g., termination) is reactive and does not prevent the launch itself.

Answer

Use AWS Config with the 'approved-amis-by-id' managed rule to evaluate and automatically remediate noncompliant instances.

Answer

Create an IAM policy that denies ec2:RunInstances for any AMI not on an approved list and attach it to all IAM users and roles.

Answer

Use AWS Systems Manager Patch Manager to approve AMIs and configure the fleet to use only approved images.

Question 2

A company wants to restrict access to an AWS Systems Manager Parameter Store parameter to only requests originating from the corporate network IP range (10.0.0.0/8). The SysOps administrator needs to implement this restriction using an IAM policy. Which condition key should be used?

Accepted Answer

aws:SourceIp. The `aws:SourceIp` condition key is designed to restrict access based on the requester's IP address. In this scenario, the corporate network IP range is 10.0.0.0/8, which is a private IPv4 address range. When used in an IAM policy, `aws:SourceIp` evaluates the source IP of the request as seen by AWS, allowing you to permit or deny access to Systems Manager Parameter Store based on that IP range.

Answer

aws:SourceVpc

Answer

aws:RequestedRegion

Answer

aws:UserAgent

Question 3

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create access keys for themselves. Which is the MOST effective way to enforce this policy across all accounts?

Accepted Answer

Attach a service control policy to the root organizational unit that denies 'iam:CreateAccessKey'.. A service control policy (SCP) attached to the root organizational unit applies to all accounts in the AWS organization, effectively denying the 'iam:CreateAccessKey' action for all IAM users and roles, including the root user (though root user actions cannot be denied by SCPs, but IAM users can be controlled). Option A is incorrect because an IAM permissions boundary limits the maximum permissions a user can have but does not deny specific actions; it also does not prevent root user actions. Option C is incorrect because an S3 bucket policy controls access to S3 resources, not IAM actions. Option D is incorrect because an IAM group policy only applies to users in that group, and users could be added outside the group or in other accounts, making it ineffective for cross-account enforcement.

Answer

Set an IAM permissions boundary on all users that denies 'iam:CreateAccessKey'.

Answer

Create an S3 bucket policy that denies access to IAM users with access keys.

Answer

Create an IAM group with a policy that denies 'iam:CreateAccessKey' and add all users to that group.

Question 4

An application running on Amazon EC2 needs to encrypt data before writing to Amazon S3. The encryption key must be rotated every 90 days and access to the key must be auditable. Which solution meets these requirements?

Accepted Answer

Use client-side encryption with a master key stored on the EC2 instance.. It allows client-side encryption, which encrypts data before writing to S3. The master key stored on the EC2 instance can be manually rotated every 90 days, meeting the rotation requirement. Auditability can be achieved by monitoring access to the EC2 instance and the key file using AWS CloudTrail and other logging services. Option A is incorrect because AWS KMS automatic rotation rotates CMKs annually, not every 90 days, so it does not meet the requirement. Option C only encrypts data in transit, not at rest. Option D provides server-side encryption with S3-managed keys, which do not support customer-controlled rotation or key usage auditing.

Answer

Use AWS KMS customer master key (CMK) with automatic rotation enabled and client-side encryption.

Answer

Use SSL/TLS to encrypt data in transit from EC2 to S3.

Answer

Use Amazon S3 server-side encryption with SSE-S3.

Question 5

A company uses AWS Key Management Service (KMS) to encrypt data in Amazon S3. They want to ensure that the KMS key can only be used from within a specific VPC. How can this be accomplished?

Accepted Answer

Add a condition in the KMS key policy using 'aws:SourceVpc' to restrict usage to the VPC.. KMS key policies are the primary resource-based policy that controls who can use a KMS key and under what conditions. Adding a condition with the 'aws:SourceVpc' key in the KMS key policy restricts key usage to requests originating from the specified VPC, which is the correct way to enforce VPC-only access to a KMS key. This is a documented AWS pattern for locking down KMS keys to a VPC.

Answer

Add a condition in the S3 bucket policy to allow only requests from the VPC.

Answer

Use an IAM policy with a condition that requires the request to come from the VPC.

Answer

Configure a network ACL that blocks all traffic to KMS except from the VPC.

Question 6

A SysOps administrator is troubleshooting an issue where an IAM user is unable to launch an EC2 instance in a specific subnet. The user has the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:Subnet": "subnet-12345"
        }
      }
    }
  ]
}

What is the likely cause of the failure?

Accepted Answer

The user is not specifying the subnet ID when launching the instance.. The IAM policy uses the condition key 'ec2:Subnet' with StringEquals, which means the RunInstances call is only allowed when the request includes a subnet ID matching subnet-12345. If the user launches an instance without specifying a subnet (for example, relying on the default VPC subnet or omitting the subnet parameter), the condition key is absent from the request context and the condition evaluates to false, so the call is denied. The likely cause is therefore that the user is not specifying the required subnet ID.

Answer

The policy does not allow the 'ec2:DescribeSubnets' action, so the user cannot list subnets.

Answer

The policy denies all subnets except subnet-12345.

Answer

The condition key 'ec2:Subnet' is not supported for RunInstances.

Question 7

A company is designing a secure application architecture. They need to ensure that sensitive data stored in Amazon S3 is not accessible from the public internet. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Use an S3 VPC Gateway Endpoint to restrict access to the VPC.. Option A is correct because an S3 VPC Gateway Endpoint lets instances in a VPC reach S3 through a private route using AWS's internal network rather than the public internet, and combined with an endpoint policy it can restrict S3 access to only that VPC. Option E is correct because enabling S3 Block Public Access at the bucket level (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) prevents any public ACL or bucket policy from granting anonymous internet access to the data. Option B is not correct for this goal because default encryption protects data at rest but does not prevent public network access. Option C is not correct because MFA Delete only adds a second factor for deleting object versions or changing versioning state, not for blocking public access. Option D is not correct because CloudFront with OAI restricts how CloudFront accesses the origin, but it does not by itself prevent direct public access to the S3 bucket unless the bucket policy also denies non-CloudFront access.

Answer

Enable default encryption on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Use Amazon CloudFront with Origin Access Identity (OAI).

Question 8

A company wants to ensure that their Amazon S3 bucket policy only allows access from a specific VPC endpoint. Which TWO condition keys can be used in the bucket policy? (Choose TWO.)

Accepted Answer

aws:SourceVpc. Option C (aws:SourceVpc) is correct because it is a global condition key that restricts access to requests originating from a specified VPC, identified by its VPC ID (e.g., vpc-1a2b3c4d), which is exactly what the company needs to limit bucket access to a particular VPC. Option E (aws:SourceVpce) is correct because it is the global condition key that restricts access based on the VPC endpoint ID (e.g., vpce-1a2b3c4d), allowing the bucket policy to permit only traffic that traverses the specified endpoint. Option A (s3:SourceVpce) is not a valid condition key for S3 bucket policies, so it cannot be used. Option B (aws:SourceIp) is a valid key but it matches on the requester's IP address, not on a VPC or endpoint, so it does not satisfy the requirement. Option D (ec2:Vpc) is not a valid IAM condition key and cannot be used in an S3 bucket policy.

Answer

s3:SourceVpce

Answer

aws:SourceIp

Answer

ec2:Vpc

Question 9

A company's security team notices that an IAM user has been making unauthorized API calls from an IP address outside the company's VPN. The team wants to immediately block all API calls from that specific IP address for all users. Which action should be taken?

Accepted Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the root organizational unit.. Service control policies (SCPs) are the only way to centrally restrict permissions across all accounts in an AWS Organization. Attaching an SCP to the root organizational unit (OU) ensures the deny applies to all users and roles in all accounts under that OU. This immediately blocks API calls from the specified IP address for all users, as required.

Answer

Create a new IAM policy that denies access from the IP address and attach it to all users.

Answer

Create an IAM policy that denies access from the IP address and attach it to the organization root.

Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the IAM user.

Question 10

A company's security team wants to ensure that all new S3 buckets created in the AWS account are automatically encrypted with server-side encryption. What should a SysOps administrator do to enforce this?

Accepted Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to encrypt the bucket.. A service control policy (SCP) cannot deny the creation of unencrypted S3 buckets because the s3:CreateBucket API does not accept an encryption setting or expose a condition key for encryption. The correct approach is to use AWS CloudTrail to monitor CreateBucket events and trigger a Lambda function that enables default encryption on newly created buckets. Option A is wrong because Block Public Access only controls public access, not encryption. Option C is wrong because existing bucket settings do not apply to new buckets.

Answer

Enable S3 Block Public Access at the account level.

Answer

Enable default encryption on each existing bucket.

Answer

Use a service control policy (SCP) to deny creation of buckets without encryption.

Question 11

An organization requires that all data in transit between EC2 instances and the internet be encrypted. Which AWS service can be used to enforce this requirement?

Accepted Answer

Use an Application Load Balancer (ALB) with a TLS listener.. An Application Load Balancer (ALB) with a TLS listener terminates TLS and enforces encryption in transit between clients and the ALB, and can also re-encrypt to backend EC2 instances. This is the AWS-native way to enforce encrypted data in transit for internet-facing traffic. The ALB listener can be configured to accept only HTTPS (TLS) and redirect HTTP to HTTPS, ensuring all traffic is encrypted.

Answer

Use a network ACL to allow only port 443.

Answer

Use a security group to allow only TLS traffic.

Answer

Use AWS Direct Connect to route all traffic.

Question 12

A company wants to grant an IAM role in Account A access to an S3 bucket in Account B. What must be configured?

Accepted Answer

A bucket policy in Account B granting access to the IAM role, and a trust policy in Account A allowing the role to assume the permissions.. To grant an IAM role in Account A access to an S3 bucket in Account B, you need two policies: a bucket policy in Account B that grants access to the IAM role, and a trust policy (also known as a permissions policy) in Account A that allows the role to assume the necessary permissions. Option B correctly describes this combination. Option A is wrong because a bucket policy alone is insufficient; the role must have permission to assume the access. Option C is wrong because a bucket policy alone is insufficient; the role needs a trust policy in Account A. Option D is wrong because an IAM role policy in Account A alone is insufficient; the bucket policy must explicitly grant access to the role.

Answer

A trust policy in Account B allowing the IAM role to access the bucket.

Answer

A bucket policy in Account B allowing access from the IAM role.

Answer

An IAM role in Account A with a policy allowing access to the bucket.

Question 13

A company wants to allow an external auditor to read objects in a specific S3 bucket for 30 days. The auditor does not have an AWS account. Which method should be used?

Accepted Answer

Generate presigned URLs for the objects.. Presigned URLs grant temporary access to specific objects without requiring AWS credentials. Option A is wrong because bucket policies require the auditor to have AWS credentials. Option B is wrong because IAM users require credentials. Option D is wrong because CloudFront does not provide temporary access by itself.

Answer

Create a bucket policy that allows the auditor's IP address.

Answer

Create an IAM user for the auditor and share the credentials.

Answer

Use CloudFront signed URLs.

Question 14

An organization wants to enforce that all IAM users have multi-factor authentication (MFA) enabled before they can perform any action except changing their own password. Which IAM policy element is MOST appropriate?

Accepted Answer

Use a Condition element with 'aws:MultiFactorAuthPresent' set to 'true' in a Deny policy.. Using a Condition element with 'aws:MultiFactorAuthPresent' set to 'true' in a Deny policy effectively requires MFA because it denies actions if MFA is not present, except for allowed exceptions. Option B is incorrect because an Action element alone does not enforce MFA; it only specifies which actions are allowed or denied. Option C is incorrect because a NotAction element allows actions that are not listed, but it does not enforce MFA conditions. Option D is incorrect because a Resource element defines which resources the policy applies to, but it does not enforce MFA requirements.

Answer

Use an Action element to allow only MFA actions.

Answer

Use a NotAction element to allow password change without MFA.

Answer

Use a Resource element to limit access to MFA-enabled users.

Question 15

A SysOps administrator needs to provide a developer from another AWS account access to an S3 bucket in the administrator's account. The developer must be able to list objects and get objects from the bucket. The administrator does NOT want to share AWS access keys. Which solution meets these requirements?

Accepted Answer

Attach a bucket policy to the S3 bucket that grants s3:ListBucket and s3:GetObject to the developer's IAM user ARN.. An S3 bucket policy can grant cross-account access directly to the developer's IAM user ARN without sharing long-term credentials. The policy specifies s3:ListBucket on the bucket ARN and s3:GetObject on the object ARN (bucket/*), which exactly matches the required permissions. This is the standard cross-account S3 access pattern.

Answer

Create an IAM user in the administrator's account and share the access key and secret key with the developer.

Answer

Generate pre-signed URLs for all objects and share them with the developer.

Answer

Grant the developer's AWS account root user access to the bucket using a bucket policy.

Question 16

A company uses IAM roles to grant EC2 instances access to S3 buckets. After a recent security audit, the SysOps administrator must ensure that only instances with a specific tag (Environment=Production) can assume the role. How can this be achieved?

Accepted Answer

Add a condition in the role's trust policy that checks for the instance's tag using the aws:ResourceTag condition key.. EC2 instance roles are assumed via the instance metadata service, and the role's trust policy can include a condition using the aws:ResourceTag condition key to require that the instance bears the Environment=Production tag. This enforces tag-based access control at the AssumeRole boundary without creating per-instance roles.

Answer

Create a new IAM role for each instance and attach the tag.

Answer

Use a service control policy (SCP) to deny the ec2:AssumeRole action for instances without the required tag.

Answer

Modify the instance profile to include the tag requirement.

Question 17

An organization uses AWS KMS to encrypt data in S3. A SysOps administrator needs to ensure that KMS keys cannot be deleted accidentally. What is the MOST effective way to protect against accidental key deletion?

Accepted Answer

Set a high waiting period (e.g., 30 days) for key deletion and require multi-factor authentication (MFA) for the deletion.. The most effective protection against accidental KMS key deletion is to set a long waiting period (up to 30 days) and require MFA for the deletion operation. The waiting period gives administrators a window to cancel a scheduled deletion, and MFA adds a strong authentication barrier so a compromised credential alone cannot delete the key.

Answer

Disable the KMS key so it cannot be used but can still be deleted.

Answer

Create a backup of the KMS key in another AWS Region.

Answer

Use a service control policy (SCP) to deny the kms:ScheduleKeyDeletion action.

Question 18

A SysOps administrator receives an alert that an IAM user's access key was used from an unexpected geographic location. What should the administrator do to prevent future unauthorized use?

Accepted Answer

Add a condition to the IAM user's policy that denies access from outside the expected region. Adding an IAM policy condition that denies access from outside the expected region directly addresses the root cause — the access key was used from an unexpected geographic location. IAM policy conditions using aws:RequestedRegion or aws:SourceIp can restrict where credentials are valid, preventing future unauthorized geographic use without disrupting legitimate access. This is the least disruptive, most targeted remediation for the stated problem.

Answer

Disable the IAM user's account immediately

Answer

Enable multi-factor authentication (MFA) for the IAM user

Answer

Delete the IAM user's access key and create a new one

Question 19

A SysOps administrator needs to securely transfer a large dataset from an on-premises server to an Amazon S3 bucket. The data is sensitive and must be encrypted in transit and at rest. Which THREE steps should the administrator take? (Choose three.)

Accepted Answer

Create an S3 endpoint policy that only allows access from the on-premises IP range. To securely transfer data, you should enable S3 bucket-side encryption (SSE-KMS or SSE-S3) for encryption at rest, use an S3 endpoint policy to restrict access (e.g., only allow from specific VPC), and use AWS CLI with --sse flag to enforce server-side encryption during upload. While HTTPS is mandatory, it's implicitly used; the explicit steps are the other three. Using public endpoints would expose data; disabling HTTPS would break encryption in transit.

Answer

Disable public access to the S3 bucket

Answer

Use an S3 bucket policy that denies requests unless they are made over HTTPS

Question 20

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files from the S3 bucket. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable CloudTrail log file validation. Option C is correct because an SCP attached to the relevant OUs or the organization root can explicitly deny cloudtrail:StopLogging and cloudtrail:DeleteTrail, preventing any principal in member accounts from disabling or deleting the trail even if they have IAM permissions. Option E is correct because an S3 bucket policy that denies s3:DeleteObject on the CloudTrail log bucket blocks deletion of the log objects themselves, protecting the audit data at the resource level. Option A is correct because enabling CloudTrail log file validation creates a digest file with a digital signature for each log file, allowing you to verify that logs have not been altered or deleted after delivery. Option B is not required for preventing disabling or deletion; sending logs to CloudWatch Logs only provides real-time monitoring and does not stop StopLogging, DeleteTrail, or object deletion. Option D is not sufficient by itself and is not one of the required three actions; MFA delete adds protection against accidental or unauthorized bucket versioning changes and object deletions but does not prevent disabling CloudTrail or deleting trails, and it is not the specified control for this scenario.

Answer

Send CloudTrail logs to CloudWatch Logs for real-time monitoring

Answer

Enable MFA delete on the S3 bucket