SOA-C02 Security and Compliance Practice Test 10 — 15 Questions

Question 1

Which TWO IAM policy conditions can be used to enforce multi-factor authentication (MFA) for API calls? (Choose two.)

Accepted Answer

aws:MultiFactorAuthPresent. Options B and C are correct. The condition key 'aws:MultiFactorAuthPresent' checks if MFA was used (a Boolean condition). The condition key 'aws:MultiFactorAuthAge' checks how long ago MFA was authenticated (a numeric condition). Option A is wrong because 'aws:PrincipalType' is for distinguishing user, role, or federated principal types, not MFA. Option D is wrong because 'aws:TokenIssueTime' is a valid condition key but it checks when the temporary credential was issued, not MFA. Option E is wrong because 'aws:SourceIp' is for IP address filtering.

Answer

aws:PrincipalType

Answer

aws:TokenIssueTime

Answer

aws:SourceIp

Question 2

An S3 bucket policy is shown in the exhibit. The AdminRole attempts to upload an object to my-bucket without specifying any server-side encryption header. What will happen?

Accepted Answer

The upload fails because the Deny statement denies PutObject without encryption.. The Deny statement denies PutObject when encryption is not aws:kms. Since the request has no encryption header, it does not equal aws:kms, so the Deny applies and the upload fails. The Allow statement allows the action only when encryption is aws:kms, so without encryption, it does not apply. Because the Deny overrides Allow, the upload is denied. Option A is wrong because the Allow does not apply. Option B is wrong because the Deny applies. Option C is wrong because the Deny does apply to the AdminRole.

Answer

The upload fails because the Allow statement requires encryption, but the Deny statement is evaluated first.

Answer

The upload succeeds because the Allow statement grants permission to the AdminRole.

Answer

The upload succeeds because the Deny statement does not apply to the AdminRole.

Question 3

A SysOps administrator runs the AWS CLI command shown in the exhibit. What is the purpose of this command?

Accepted Answer

To retrieve details about the most recent console login events.. The command `aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin` retrieves CloudTrail events where the event name is 'ConsoleLogin', which corresponds to sign-in events to the AWS Management Console. This provides details about recent console login events, such as who logged in, when, and from where. Option D is incorrect because this command does not disable CloudTrail logging; it only queries existing events. Option B is incorrect because the command retrieves events, not counts. Option C is incorrect because the filter is by event name, not by user.

Answer

To count the number of console logins in the last 5 minutes.

Answer

To retrieve a list of all API calls made by the user john.doe.

Answer

To disable CloudTrail logging for console login events.

Question 4

A CloudFormation template creates an S3 bucket with encryption and a bucket policy as shown in the exhibit. An administrator tries to upload an object using the AWS CLI without specifying any encryption. What will happen?

Accepted Answer

The upload fails because the bucket policy denies PutObject without the encryption header.. The bucket policy denies PutObject if the encryption header is not AES256. Since the request has no encryption header, it does not equal AES256, so the Deny applies and the upload fails. The bucket's default encryption (AES256) applies only if the request does not specify encryption; however, the bucket policy is evaluated before the default encryption is applied, so the Deny takes effect. Option A is wrong because the policy denies it. Option B is wrong because default encryption does not satisfy the policy condition. Option D is wrong because the policy explicitly denies.

Answer

The upload succeeds because the bucket has default encryption enabled.

Answer

The upload fails because the bucket policy allows only objects with AES256 encryption, but the default encryption is sufficient.

Answer

The upload succeeds because the default encryption automatically adds the AES256 header.

Question 5

A company is using AWS KMS to encrypt data at rest in S3. The security team wants to ensure that encryption keys are automatically rotated annually. Which type of KMS key should be used?

Accepted Answer

Use an AWS managed key. AWS managed KMS keys (AWS managed keys) are automatically rotated every year (365 days) with no action required from the customer. This satisfies the security team's requirement for annual automatic key rotation without any manual intervention or additional configuration.

Answer

Use an asymmetric KMS key

Answer

Use a custom key store (CloudHSM)

Answer

Use a customer managed key with imported key material

Question 6

A SysOps administrator needs to grant cross-account access to an S3 bucket in Account A for an IAM user in Account B. The bucket policy in Account A allows the IAM user's account root principal. What additional configuration is required?

Accepted Answer

Attach an IAM policy to the user in Account B that allows the required S3 actions. D is correct because cross-account access to an S3 bucket requires both a bucket policy that grants access to the root principal of the target account (Account B) and an IAM policy attached to the user in Account B that explicitly allows the desired S3 actions. Without the IAM policy, the user in Account B has no permissions to perform any S3 operations, even though the bucket policy in Account A permits the account root. The IAM policy acts as the identity-based permission that authorizes the specific user to invoke the S3 API calls.

Answer

Modify the AWS KMS key policy to allow the user in Account B

Answer

Add a bucket ACL granting access to the user in Account B

Answer

Add an AWS Organizations service control policy to allow access

Question 7

A company has an S3 bucket configured to log all access requests to another bucket. The security team notices that some delete requests are not being logged. What is the most likely cause?

Accepted Answer

The delete requests were made through AWS CloudTrail, which bypasses S3 access logging. S3 server access logs record all requests made to a bucket, including DELETE requests, regardless of whether they are made via the AWS Management Console, CLI, SDK, or CloudTrail. CloudTrail is a separate auditing service that logs API calls, but it does not bypass S3 access logging. The most likely cause of missing delete requests is that S3 server access log delivery is best-effort and can occasionally be incomplete or delayed, or the logging configuration may be misconfigured (e.g., missing permissions on the destination bucket). Among the given options, none is correct.

Answer

The bucket policy denies logging of delete requests

Answer

The bucket has MFA Delete enabled, and the logging configuration does not capture MFA delete requests

Answer

S3 server access logs do not capture DELETE requests

Question 8

A SysOps administrator is troubleshooting an IAM policy that is not granting the expected permissions. The policy has a Deny effect on a specific action, but the user is still able to perform that action. What is the most likely reason?

Accepted Answer

The Deny statement includes a condition that is not met by the request. IAM policy evaluation logic: by default, all requests are implicitly denied. An explicit allow overrides the default deny, and an explicit deny overrides any allow. If a Deny statement includes a condition, the Deny is only applied when the condition evaluates to true. If the condition is not met (e.g., the request does not match the specified IP address range or time), the Deny statement is not applied, and the action may be allowed by other policies. Therefore, the most likely reason the user can still perform the action is that the Deny statement's condition is not satisfied, making option C correct.

Answer

The Deny statement is listed after an Allow statement in the policy

Answer

IAM policies do not support deny statements with conditions

Answer

The user has an attached AWS managed policy that allows the action

Question 9

A company wants to ensure that all S3 buckets are encrypted by default. Which AWS service can be used to automatically enforce encryption on newly created S3 buckets?

Accepted Answer

AWS Config with a managed rule and auto-remediation. AWS Config can evaluate resources against rules and take remediation actions. Using a managed rule like 's3-bucket-server-side-encryption-enabled' and an auto-remediation action, AWS Config can automatically apply encryption to newly created S3 buckets that are non-compliant. Option A is correct. Option B is wrong because S3 bucket policies can require encryption in requests but cannot automatically enforce encryption on buckets. Option C is wrong because IAM policies can require encryption in requests but cannot automatically apply encryption to buckets. Option D is wrong because AWS CloudTrail logs API calls and does not enforce configurations.

Answer

S3 bucket policies

Answer

IAM policies

Answer

AWS CloudTrail

Question 10

A company has an EC2 instance that needs to access an S3 bucket. The instance is launched in a private subnet with no internet gateway. What is the most secure way to provide access to S3 without traversing the internet?

Accepted Answer

Create an S3 VPC gateway endpoint. An S3 VPC gateway endpoint allows EC2 instances in a private subnet to access S3 privately using AWS’s internal network, without requiring an internet gateway, NAT gateway, or public IP. Traffic stays within the AWS backbone, never traversing the internet, which provides the most secure and cost-effective solution for this scenario.

Answer

Use a NAT gateway in a public subnet

Answer

Set up an AWS Direct Connect connection

Answer

Attach an internet gateway to the VPC and a public IP to the instance

Question 11

A SysOps administrator notices that an IAM user can access the AWS Management Console but cannot use the AWS CLI. The user has a password and an access key. What is the most likely cause?

Accepted Answer

The IAM policy denies CLI access unless MFA is present. The most likely cause is that the user's IAM policy includes a condition that denies CLI access unless MFA is present. The AWS CLI uses access keys for authentication, and if a policy explicitly requires MFA for API calls (e.g., via `aws:MultiFactorAuthPresent` condition key), CLI requests will be denied even though console access (which can enforce MFA separately via a sign-in policy) remains functional. This scenario is common when an administrator has attached a policy like `DenyAllExceptWithMFA` to the user or a group.

Answer

The secret access key was not saved during creation

Answer

The user's access key is inactive

Answer

The user is using the wrong password for the CLI

Question 12

A company wants to centrally manage access to AWS accounts for its employees. Which AWS service should be used to create and manage users and groups across multiple accounts?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (successor to AWS SSO) allows you to centrally create and manage users and groups and assign them single sign-on access to multiple AWS accounts. Option C is correct. Option A (AWS IAM) is wrong because IAM is per-account and not designed for cross-account user management. Option B (AWS Directory Service) is wrong because it provides managed Microsoft Active Directory, not multi-account user management. Option D (AWS Organizations) is wrong because it manages accounts and policies, not users and groups.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS Organizations

Question 13

A company has an S3 bucket with versioning enabled. They want to ensure that objects are not permanently deleted by users. What configuration should be applied?

Accepted Answer

Enable MFA Delete on the bucket. With versioning enabled, a delete request creates a delete marker instead of actually deleting the object. However, users with the s3:DeleteObject permission can still permanently delete specific versions. To prevent permanent deletion, you can enable MFA Delete, which requires multi-factor authentication to change the versioning state or permanently delete versions. Option A is correct. Option B is wrong because a lifecycle policy can delete noncurrent versions after a period, but it does not prevent user-initiated permanent deletions. Option C is wrong because a bucket policy that denies s3:DeleteObject does not prevent users with delete permissions from creating delete markers; it only prevents the actual deletion of objects. Option D is wrong because S3 Object Lock in governance mode prevents deletion during a retention period, but it is not specifically for preventing all permanent deletions by users; it is for compliance and requires setting retention periods.

Answer

Configure a lifecycle policy to expire noncurrent versions

Answer

Enable S3 Object Lock in governance mode

Answer

Add a bucket policy that denies s3:DeleteObject

Question 14

Which TWO actions can be taken to secure an S3 bucket that contains sensitive data? (Choose two.)

Accepted Answer

Enable default encryption for the bucket. Blocking all public access at the account level (Option E) prevents any public access to all buckets in the account, ensuring sensitive data is not exposed. Enabling default encryption (Option C) ensures that all objects uploaded to the bucket are encrypted at rest, protecting data even if the bucket or objects are compromised. Option A is incorrect because versioning protects against accidental deletion or overwrite, but does not secure data. Option B is incorrect; while a bucket policy that allows only HTTPS enforces encryption in transit, it is not the most direct or comprehensive security measure for sensitive data. Option D is incorrect because AWS CloudTrail logs API activity but does not directly secure the bucket.

Answer

Enable versioning on the bucket

Answer

Add a bucket policy that allows only HTTPS requests

Answer

Enable AWS CloudTrail for the bucket

Question 15

A company uses AWS KMS to encrypt EBS volumes. Which TWO statements about using KMS with EBS are correct? (Choose two.)

Accepted Answer

You can import key material for EBS encryption. AWS managed KMS keys (aws/ebs) are automatically rotated annually, meaning AWS generates new cryptographic material for the key each year. This rotation is seamless and does not require any action from the user. Additionally, EBS encryption supports both customer managed and AWS managed KMS keys. Furthermore, EBS supports the use of imported key material for encryption, allowing you to bring your own key material by using a customer managed key with a custom key store. Therefore, options A, B, and C are correct.

Answer

EBS supports asymmetric KMS keys

Answer

You must specify a KMS key when creating a snapshot