SOA-C02 Security and Compliance Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user. The user's IP address is 10.0.1.5. What is the result when the user tries to download an object from the folder 'confidential' in 'example-bucket'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The request is denied because of the explicit Deny statement.. The policy contains an explicit Deny for the 'confidential' folder. In IAM, an explicit Deny overrides any Allow. Therefore, even if the user's IP is within the allowed range, the Deny blocks the download. Options B, C, and D are incorrect because the Deny is unconditional and does not depend on IP address.

Answer

The request is allowed because the Deny statement only applies if the IP is outside the range.

Answer

The request is allowed because the user's IP matches the allowed range.

Answer

The request is denied because the Deny statement applies only when the IP is outside the range.

Question 2

Refer to the exhibit. A company has a CloudTrail trail in us-east-1 that logs events for that region only. The company operates in multiple regions and wants to ensure all API calls from all regions are logged. What is the most efficient way to achieve this?

Accepted Answer

Update the existing trail to be a multi-region trail.. Updating the existing trail to be a multi-region trail is the most efficient way to log events from all regions. A multi-region trail logs API calls from all AWS regions into a single trail, aggregating them in the same S3 bucket. Option A is incorrect because CloudWatch Events can capture API calls, but it is less efficient and more complex than using a multi-region trail. Option B is incorrect because S3 event notifications are triggered by S3 events, not API calls, and cannot capture all API calls. Option C is incorrect because creating a new trail in each region results in multiple trails and log files, which is less efficient to manage than a single multi-region trail.

Answer

Use Amazon CloudWatch Events to capture API calls from all regions.

Answer

Use S3 event notifications to trigger a Lambda function that logs API calls.

Answer

Create a new CloudTrail trail in each region.

Question 3

Refer to the exhibit. An IAM policy allows a user to run instances only of type t2.micro. What happens when the user tries to run a t2.small instance?

Accepted Answer

The request is denied because t2.small does not match the condition.. The IAM policy includes a condition that restricts ec2:RunInstances to the t2.micro instance type. When the user attempts to launch a t2.small instance, the condition evaluates to false, so the statement does not apply and the request is implicitly denied. IAM policies are deny-by-default, so the absence of an allow results in denial.

Answer

The request is allowed because the policy allows ec2:RunInstances.

Answer

The request is denied because there is an explicit deny on ec2:RunInstances.

Answer

The request is allowed because the condition only applies to the resource ARN, not the instance type.

Question 4

A SysOps administrator discovers that an EC2 instance was compromised because the SSH key pair was leaked. The administrator wants to ensure that future access to EC2 instances is secured using a method that does not rely on static keys. Which solution should the administrator implement?

Accepted Answer

Use EC2 Instance Connect to connect to instances.. EC2 Instance Connect allows you to connect to EC2 instances using IAM policies and does not require managing or distributing static SSH key pairs. This eliminates the risk of key leakage. Option A (bastion host with limited IP range) still relies on SSH key pairs for authentication. Option B (create new key pair) continues to use static keys and does not address the root cause. Option C (Systems Manager Session Manager) provides secure access without keys, but it requires the SSM Agent and an IAM instance role, and is not as directly focused on SSH key replacement as EC2 Instance Connect. Therefore, Option D is the best solution.

Answer

Use a bastion host with a security group that allows SSH from a limited IP range.

Answer

Create a new key pair and distribute it securely to authorized users.

Answer

Use AWS Systems Manager Session Manager to connect to instances.

Question 5

A company's compliance team requires that all changes to IAM policies be logged and immediately alerted. Which AWS solution should be used?

Accepted Answer

Use AWS CloudTrail to log API calls and Amazon CloudWatch Events to send alerts.. AWS CloudTrail records every IAM API call (CreatePolicy, AttachRolePolicy, PutRolePolicy, etc.) as a management event, and CloudWatch Events (now EventBridge) can match those events with a rule and trigger an SNS notification or Lambda for immediate alerting. This combination satisfies both the logging and the real-time alerting requirements.

Answer

Use AWS Config rules to monitor IAM policy changes and send notifications.

Answer

Use Amazon CloudWatch Logs to capture IAM policy changes and create metric filters.

Answer

Use Amazon GuardDuty to detect unauthorized IAM policy changes.

Question 6

A SysOps administrator needs to ensure that an EC2 instance can access an S3 bucket without storing AWS credentials on the instance. What should the administrator do?

Accepted Answer

Create an IAM role with S3 access and attach it to the instance profile.. The correct approach is to create an IAM role with the required S3 permissions and attach it to the EC2 instance profile, so the instance's SDK/CLI can retrieve temporary credentials from the instance metadata service (IMDS). This eliminates the need to store long-term AWS credentials on the instance and follows AWS best practices for least privilege and credential hygiene.

Answer

Create a bucket policy that allows access from the instance's public IP.

Answer

Store the access key and secret key in a file on the instance.

Answer

Configure the security group to allow outbound traffic to S3.

Question 7

A company requires that all API calls to AWS services be logged for compliance. The logs must be stored in a centralized S3 bucket with server-side encryption enabled. Which AWS service should be used to capture the API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity across AWS services, capturing who made what call, from where, and when, and can deliver logs to a centralized S3 bucket with SSE enabled. It is the designated service for auditing API calls for compliance.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 8

An administrator needs to grant an IAM user the ability to stop and start EC2 instances, but only for instances tagged with 'Environment:Production'. Which IAM policy element should be used to enforce this condition?

Accepted Answer

Condition. The Condition element in an IAM policy allows specifying conditions, such as restricting actions to instances with a specific tag (e.g., 'Environment:Production'). Option A is incorrect because Effect determines whether the policy allows or denies access. Option B is incorrect because Resource specifies the ARN of the resources the policy applies to. Option C is incorrect because Action specifies the specific operations (e.g., ec2:StopInstances) that are allowed or denied.

Answer

Effect

Answer

Resource

Answer

Action

Question 9

A company uses AWS Organizations with SCPs to restrict member accounts. The security team wants to prevent all users in the 'Developers' OU from deleting S3 buckets, except for the root user of the management account. How should this be implemented?

Accepted Answer

Attach an SCP that denies s3:DeleteBucket to the Developers OU. The management account root is not affected by SCPs.. SCPs applied to an OU restrict what member accounts can do, but they do not affect the management account. The management account root user is not constrained by SCPs, so attaching a deny s3:DeleteBucket SCP to the Developers OU prevents users in that OU from deleting buckets while leaving the management account root unaffected. This matches the requirement exactly.

Answer

Create an IAM policy that denies s3:DeleteBucket and attach it to all IAM users. The root user is not affected by IAM policies.

Answer

Attach an SCP that denies s3:DeleteBucket except when called by root user.

Answer

Attach an SCP that denies s3:DeleteBucket to the Developers OU. The root user in member accounts is not affected.

Question 10

A SysOps administrator needs to ensure that data in an S3 bucket is encrypted at rest. The bucket already has server-side encryption with S3 managed keys (SSE-S3) enabled. Which additional step is required to enforce encryption for all objects?

Accepted Answer

Add a bucket policy that denies PutObject without encryption.. A bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, thereby enforcing encryption for all uploads. Option B is incorrect because CloudTrail logs API calls but does not enforce encryption. Option C is incorrect because enabling default encryption on the bucket only encrypts objects that are uploaded without specifying encryption, but it does not prevent unencrypted uploads; a bucket policy is needed to enforce encryption. Option D is incorrect because versioning allows multiple versions of objects but does not enforce encryption.

Answer

Enable CloudTrail to log unencrypted uploads.

Answer

Enable default encryption on the bucket.

Answer

Enable versioning on the bucket.

Question 11

A company has a legacy application that requires access to an S3 bucket using an IAM user's access keys. The security team wants to rotate the access keys every 90 days automatically. What is the MOST efficient way to achieve this?

Accepted Answer

Store the access keys in AWS Secrets Manager and use automatic rotation.. AWS Secrets Manager provides built-in automatic rotation for IAM user access keys, allowing you to set a 90-day rotation schedule without custom code. Option A is incorrect because while AWS Lambda with a scheduled CloudWatch Events rule could rotate keys, it requires custom code and is less efficient than the managed rotation in Secrets Manager. Option B is incorrect because a script on an EC2 instance using cron would require additional infrastructure and maintenance. Option D is incorrect because there is no built-in IAM access key rotation in the IAM console; you must manually rotate keys each time.

Answer

Use AWS Lambda with a scheduled CloudWatch Events rule to rotate the keys.

Answer

Create a script that runs on an EC2 instance using cron to rotate the keys.

Answer

Enable IAM access key rotation in the IAM console.

Question 12

An administrator notices that an EC2 instance has been compromised. The instance is part of an Auto Scaling group. What should the administrator do FIRST to contain the incident?

Accepted Answer

Detach the instance from the Auto Scaling group and apply a security group that denies all traffic.. The correct first step is to detach the instance from the Auto Scaling group and apply a security group that denies all traffic. This isolates the compromised instance, preventing further damage while preserving evidence for forensic analysis. Option A is incorrect because changing the launch configuration does not affect running instances. Option B is incorrect because immediate termination may destroy evidence. Option D is incorrect because deleting the Auto Scaling group is an extreme measure and not the immediate containment step.

Answer

Update the Auto Scaling group's launch configuration to use a different AMI.

Answer

Terminate the instance immediately.

Answer

Delete the Auto Scaling group.

Question 13

A company stores sensitive data in an RDS database. Which AWS service should be used to encrypt the database at rest?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the AWS service that manages the customer master keys (CMKs) used to encrypt RDS databases at rest. When you enable encryption on an RDS instance, you select a KMS key, and RDS uses that key to encrypt the underlying storage, snapshots, and read replicas. KMS integrates natively with RDS, EBS, S3, and most other AWS services for at-rest encryption.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM

Question 14

Which TWO actions should a SysOps administrator take to secure an AWS account root user? (Choose two.)

Accepted Answer

Enable multi-factor authentication (MFA) for the root user.. Option C is correct because enabling MFA on the root user adds a second authentication factor, so a stolen root password alone cannot be used to sign in to the account. Option E is correct because the root user's access keys grant unrestricted programmatic access that cannot be scoped down by IAM policies, so AWS best practice is to never create them and instead use IAM roles or IAM users. Option A is wrong because the root user cannot be deleted; it is permanently tied to the account and can only have its credentials rotated or removed. Option B is wrong because SCPs apply to member accounts in AWS Organizations and do not restrict the root user of the management account, nor can they meaningfully limit root credentials. Option D is wrong because CloudTrail provides monitoring and audit logging of root activity, not a preventive control that secures the root user.

Answer

Delete the root user after creating an admin IAM user.

Answer

Apply a service control policy (SCP) to restrict the root user.

Answer

Enable CloudTrail to monitor root user activity.

Question 15

Which THREE are valid methods to control access to an S3 bucket? (Choose three.)

Accepted Answer

Access control lists (ACLs). Option B (Access control lists, ACLs) is correct because S3 ACLs are a legacy but still supported access-control mechanism that grants read/write permissions on a bucket or object to AWS accounts or predefined groups such as AllUsers or AuthenticatedUsers. Option C (Bucket policies) is correct because an S3 bucket policy is a resource-based JSON policy attached directly to the bucket that can allow or deny principals (IAM users, roles, accounts, or anonymous users) access to the bucket and its objects. Option D (IAM user policies) is correct because identity-based IAM policies attached to users, groups, or roles define what S3 actions (for example s3:GetObject, s3:PutObject) those identities may perform on specified bucket ARNs. Option A (VPC Flow Logs) is not an access-control method; it captures IP traffic metadata for network interfaces for monitoring and troubleshooting. Option E (CloudWatch Logs) is a logging and monitoring service, not an authorization mechanism, so it cannot grant or deny access to an S3 bucket.

Answer

VPC Flow Logs

Answer

CloudWatch Logs