SOA-C02 Security and Compliance Practice Test 11 — 15 Questions

Question 1

A SysOps administrator applies the IAM policy shown in the exhibit to an IAM user. The user tries to upload an object to the S3 bucket without specifying encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. Option B is correct because the policy requires SSE-S3 (AES256), and if the user does not specify encryption, the request does not satisfy the condition, so the action is denied. Option A is wrong because the condition is not met. Option C is wrong because the policy does not allow unencrypted uploads. Option D is wrong because the condition is not met.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-KMS encryption.

Answer

The upload succeeds with default encryption.

Question 2

A SysOps administrator deploys the CloudFormation template shown in the exhibit. The stack creation fails with a security group error. What is the most likely cause?

Accepted Answer

The template uses 'SecurityGroups' instead of 'SecurityGroupIds' for a VPC instance.. Option C is correct because the security group ingress rule uses a CIDR that is not a specific IP range; although 10.0.0.0/8 is private, it is allowed, but the error might be due to missing VPC reference. However, more importantly, the security group is created without a VPC ID, which is required for EC2-Classic? Actually, in EC2-VPC, security groups must be in a VPC. The template does not specify a VPC, so it uses the default VPC. But the most likely cause is that the security group ingress rule allows SSH from a large CIDR, which is a security risk but not a failure. Actually, the error is likely because the security group is not associated with a VPC? Wait, the template does not specify VpcId, so it uses the default VPC. But if the default VPC does not exist, it fails. However, a more common issue is that the security group ingress rule uses a CidrIp that is not valid for the VPC. But the exhibit shows 10.0.0.0/8, which is valid. Actually, the most likely cause is that the security group is not associated with a VPC, but that is automatically handled. Alternatively, the error could be because the security group name is already used. But the most plausible is that the security group ingress rule is malformed because it should specify CidrIp or SourceSecurityGroup, and it does. I'll go with option C: The security group ingress rule uses a CIDR that is not allowed in the VPC (10.0.0.0/8 is private, but it's allowed). Hmm, let's reconsider. The template has a bug: it uses "SecurityGroups" (plural) instead of "SecurityGroupIds" or "SecurityGroups" is a list of group names, but it's referencing a Ref to a security group, which returns the group ID, not name. So the correct property is "SecurityGroupIds" for VPC. That is a common mistake. So option A could be correct. I'll set option A as correct: The template uses "SecurityGroups" instead of "SecurityGroupIds" for a VPC instance. So the answer is A.

Answer

The AMI ID is incorrect.

Answer

The security group ingress rule uses an invalid CIDR.

Answer

The security group ingress rule allows SSH from all IPs.

Question 3

A SysOps administrator is investigating an unauthorized stop of an EC2 instance. The CloudTrail log entry shows the event. What is the first step to determine if the action was authorized?

Accepted Answer

Check the IAM permissions of the user 'Admin' at the time of the event.. Option B is correct because the event shows an IAM user "Admin" and a source IP. Checking the IAM permissions for that user at the time of the event will show if they had the ec2:StopInstances permission. Option A is wrong because the event is already in CloudTrail. Option C is wrong because the instance state change is in CloudTrail. Option D is wrong because the user agent shows console.

Answer

Check the S3 bucket where CloudTrail logs are stored.

Answer

Verify the source IP address belongs to the company.

Answer

Check the EC2 instance's state change history.

Question 4

A company has a fleet of EC2 instances in an Auto Scaling group behind an Application Load Balancer. The security team requires that all traffic to the instances be encrypted in transit. Currently, the ALB terminates HTTPS and forwards HTTP to the instances. The security team wants to ensure that the traffic between the ALB and the instances is also encrypted. What should the SysOps administrator do to meet this requirement with minimal changes?

Accepted Answer

Change the ALB listener to use HTTPS and configure the target group to use HTTPS with a self-signed certificate on the instances.. Option B is correct because you can create a TLS listener on the ALB that targets a target group using HTTPS. Option A is wrong because NLB does not support HTTPS health checks? Actually, NLB can handle TLS, but it requires more configuration. Option C is wrong because CloudFront adds complexity. Option D is wrong because VPN is not needed.

Answer

Replace the ALB with a Network Load Balancer and use TLS termination on the instances.

Answer

Place a CloudFront distribution in front of the ALB and use HTTPS for all origins.

Answer

Set up a VPN connection between the ALB and the instances.

Question 5

A company has an S3 bucket that stores sensitive customer data. The security team requires that all access to the bucket be logged for auditing. The SysOps administrator enabled S3 server access logging and configured the logs to be delivered to a different S3 bucket in the same account. However, after a week, the log bucket is empty. What is the most likely cause?

Accepted Answer

The log bucket has a bucket policy that denies access to the log delivery service.. Option D is correct because if the log delivery bucket has a bucket policy that denies access to the log delivery service, the logs will not be written. The S3 log delivery service uses a specific principal. Option A is wrong because the ACLs are not the issue. Option B is wrong because the log bucket is in the same account. Option C is wrong because CloudTrail is not required for S3 access logs.

Answer

The log bucket has no lifecycle policy.

Answer

The source bucket has an ACL that denies the log delivery service.

Answer

The log bucket is in a different region.

Question 6

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in member accounts must use MFA. They create an SCP that denies all actions if the IAM user does not have MFA. However, the SCP does not apply to the root user. The SysOps administrator finds that some IAM users in member accounts are still able to access the console without MFA. What is the most likely reason?

Accepted Answer

The SCP is applied to an OU that does not contain the affected accounts.. Option B is correct because SCPs do not affect the management account. The root user is in the management account, but the question says "member accounts". However, if the SCP is applied to an OU that does not include the affected accounts, it will not apply. Option A is wrong because SCPs are inherited. Option C is wrong because SCPs are not overridden by resource policies. Option D is wrong because SCPs apply to all IAM users and roles.

Answer

The IAM user has a resource-based policy that allows access.

Answer

The SCP only applies to the root user, not IAM users.

Answer

The SCP is not inherited by child OUs.

Question 7

A company uses AWS KMS to encrypt data stored in S3. The security team wants to rotate the KMS key automatically every year. The SysOps administrator enabled automatic key rotation for the KMS key. However, after a year, the security team finds that the key has not been rotated. What is the most likely cause?

Accepted Answer

The KMS key was created by importing key material.. Option C is correct because automatic key rotation is not supported for imported key material. Option A is wrong because the key is enabled. Option B is wrong because the policy does not affect rotation. Option D is wrong because rotation does not require deletion of old keys.

Answer

The KMS key is disabled.

Answer

The KMS key policy does not allow rotation.

Answer

The KMS key has not been used in the last year.

Question 8

A company stores sensitive data in an S3 bucket. The security team requires that all objects uploaded to the bucket be encrypted at rest using an AWS KMS customer-managed key. Which S3 bucket policy statement should be added to enforce this requirement?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. Option C is correct because the condition 's3:x-amz-server-side-encryption-aws-kms-key-id' checks that the specific KMS key is used, and the condition 's3:x-amz-server-side-encryption' ensures encryption is enforced. Option A is wrong because it allows SSE-S3. Option B is wrong because it allows SSE-KMS but does not restrict to a specific key. Option D is wrong because it denies all uploads without encryption, but does not require the specific KMS key.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Question 9

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all new S3 buckets created in any account have encryption enabled. Which approach should be used to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes the x-amz-server-side-encryption header with a valid encryption algorithm.. Option A is correct because SCPs can be applied to all accounts in the organization to deny creation of S3 buckets without encryption. Option B is wrong because IAM roles are per account and not centrally enforced. Option C is wrong because CloudTrail is for logging, not enforcement. Option D is wrong because Config rules detect non-compliance but do not prevent creation.

Answer

Create an IAM role in each member account with a policy that denies s3:CreateBucket without encryption, and require all users to assume that role.

Answer

Use AWS Config managed rule 's3-bucket-server-side-encryption-enabled' to detect non-compliant buckets and automatically remediate.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers a Lambda function to delete any bucket created without encryption.

Question 10

A company uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. Which configuration step is required?

Accepted Answer

Configure the target group to use HTTPS protocol and install SSL/TLS certificates on the instances.. Option B is correct because configuring the target group with HTTPS health checks and expecting HTTPS traffic ensures that the ALB communicates with the instances over HTTPS. Option A is wrong because the listener handles client-facing encryption, not backend. Option C is wrong because security groups control access but not encryption. Option D is wrong because the ALB does not have a NAT gateway.

Answer

Configure the ALB listener to use HTTPS with a security policy.

Answer

Place the instances in a private subnet and use a NAT gateway for outbound traffic.

Answer

Create a security group rule that allows only HTTPS traffic from the ALB to the instances.

Question 11

A company wants to allow its DevOps team to launch EC2 instances using a specific AMI ID and only in a particular VPC. Which IAM policy should be used?

Accepted Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:Vpc":"vpc-12345678","ec2:ImageId":"ami-12345678"}}}. Option D is correct because it uses condition keys ec2:Vpc and ec2:ImageId to restrict the RunInstances action to the specified VPC and AMI. Option A is wrong because it only restricts the VPC but not the AMI. Option B is wrong because it restricts the AMI but not the VPC. Option C is wrong because it uses a deny statement that would block all instances not matching both conditions, which may be too restrictive for other allowed actions.

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:Vpc":"vpc-12345678"},"StringNotEquals":{"ec2:ImageId":"ami-12345678"}}}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:region::image/ami-12345678"}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:Vpc":"vpc-12345678"}}}

Question 12

A company is using AWS CodePipeline to deploy a web application. The security team requires that all code changes be reviewed and approved before deployment to production. Which action should be taken to enforce this requirement?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline before the production deployment stage.. Option A is correct because adding a manual approval action in the CodePipeline pipeline before the production deployment stage enforces a required review and approval gate. This action pauses the pipeline at that point, waiting for an authorized user to manually approve the change before it proceeds to the production stage, directly meeting the security team's requirement.

Answer

Create an IAM policy that denies the codecommit:PutFile action unless the user is in a specific group.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to notify the security team of any deployments.

Answer

Configure a CodeCommit repository to require pull requests for all changes.

Question 13

A company is using Amazon RDS for MySQL and needs to encrypt data at rest. Which action should be taken to enable encryption?

Accepted Answer

Create a new RDS DB instance with encryption enabled.. Amazon RDS for MySQL does not support enabling encryption on an existing DB instance. Encryption at rest must be enabled at the time of instance creation. Therefore, the correct action is to create a new RDS DB instance with encryption enabled, and then migrate the data from the unencrypted instance to the new encrypted one.

Answer

Use the RDS console to enable encryption on the existing DB instance.

Answer

Use AWS KMS to create a customer master key and assign it to the existing DB instance.

Answer

Modify the existing RDS DB instance and enable encryption.

Question 14

A company wants to provide temporary access to an S3 bucket for a third-party vendor. The vendor needs to upload files for one hour. Which approach should be used?

Accepted Answer

Generate a presigned URL for the S3 bucket that expires in one hour.. Option A is correct because presigned URLs can grant temporary access to a specific S3 object for a limited time. Option B is wrong because a bucket policy with a condition on the source IP would provide permanent access. Option C is wrong because creating an IAM user for the vendor is a long-term credential. Option D is wrong because cross-account roles require the vendor to have an AWS account.

Answer

Create an IAM role and allow the vendor to assume it using their AWS account.

Answer

Create an IAM user with programmatic access and share the credentials with the vendor.

Answer

Create an S3 bucket policy that allows the vendor's IP address for one hour.

Question 15

A company has a VPC with public and private subnets. The private subnets contain RDS databases that should not be accessible from the internet. Which configuration ensures that the databases are only accessible from the application servers in the public subnets?

Accepted Answer

Create a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers.. Option D is correct because security groups act as a virtual firewall at the instance level, and you can reference another security group as a source. By creating a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers, you ensure that only those application servers (regardless of their IP addresses) can reach the databases. This approach is more dynamic and secure than using CIDR-based rules, as it automatically accommodates changes in the application servers' IP addresses or scaling events.

Answer

Attach an internet gateway to the VPC and route the private subnet's traffic to it.

Answer

Attach a NAT gateway to the private subnet and route traffic through it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

SOA-C02 Security and Compliance Practice Test 11 — 15 Questions

Exhibit

SOA-C02 Security and Compliance Practice Test 11 — 15 Questions

Exhibit