SOA-C02 Security and Compliance Practice Test 11 — 15 Questions

Question 1

Which THREE security best practices should be followed when managing IAM users? (Choose three.)

Accepted Answer

Rotate access keys regularly. Rotating access keys regularly limits the window of exposure if a key is compromised. AWS recommends rotating IAM user access keys every 90 days as a security best practice, and this can be enforced using an IAM policy that checks the key's creation date via the `aws:CurrentTime` condition key.

Answer

Attach policies directly to users

Answer

Use the root user for daily administration

Question 2

Refer to the exhibit. A SysOps administrator reviews the account password policy. Which of the following is true based on this output?

Accepted Answer

Users cannot reuse their last 5 passwords. The output shows MaxPasswordAge: 90 and ExpirePasswords: true, meaning passwords expire after 90 days. PasswordReusePrevention: 5 means users cannot reuse the last 5 passwords. Option B is correct. Option A is wrong because password expiration is enabled (ExpirePasswords: true). Option C is wrong because MaximumPasswordAge is 90 days. Option D is wrong because HardExpiry is false, meaning users can change expired passwords.

Answer

Passwords do not expire

Answer

The maximum password age is 120 days

Answer

Users cannot change expired passwords

Question 3

Refer to the exhibit. A SysOps administrator creates this stack. Which of the following is true about the bucket?

Accepted Answer

The bucket has versioning enabled. The stack template enables versioning on the bucket and sets all public access block settings to true, making the bucket private. Therefore, option A is correct because versioning is enabled. Option B is incorrect because the bucket is not publicly accessible. Option C is incorrect because versioning is enabled, not disabled. Option D is incorrect because public read access is blocked.

Answer

The bucket is publicly accessible

Answer

The bucket does not have versioning enabled

Answer

The bucket allows public read access

Question 4

A company's security team notices that an IAM user has access keys that have not been rotated in over a year. Which action should the SysOps administrator take to enforce key rotation automatically?

Accepted Answer

Set up an AWS Config rule to detect old keys and trigger an AWS Lambda function to rotate them.. AWS Config can evaluate IAM user access keys against a custom or managed rule (e.g., 'access-keys-rotated') to detect keys older than a specified threshold. When a non-compliant key is found, you can configure an AWS Config rule to invoke an AWS Lambda function that programmatically deactivates the old key and creates a new one, enforcing automatic rotation. This is the only native, automated approach that combines detection and remediation without manual intervention.

Answer

Apply a service control policy (SCP) that requires key rotation.

Answer

Configure an IAM policy that automatically rotates keys every 90 days.

Answer

Use AWS Trusted Advisor to automatically rotate the keys.

Question 5

An organization wants to centrally manage access to multiple AWS accounts in an AWS Organizations setup. Which AWS service should the SysOps administrator use to define and enforce fine-grained permissions across accounts?

Accepted Answer

IAM roles with cross-account trust policies. IAM roles with cross-account trust policies allow a SysOps administrator to define fine-grained permissions centrally in a single AWS account (the management or security account) and then grant access to users or services in other accounts by assuming the role. This approach uses AWS Security Token Service (STS) to issue temporary credentials, enabling precise control over actions and resources across accounts without duplicating IAM users or policies.

Answer

AWS Config rules

Answer

Service control policies (SCPs)

Answer

AWS Single Sign-On (SSO)

Question 6

Which TWO actions can a SysOps administrator take to secure an Amazon S3 bucket that contains sensitive data? (Choose TWO.)

Accepted Answer

Enable default encryption using AWS KMS (SSE-KMS) on the bucket.. Enabling default encryption with SSE-KMS ensures that all objects uploaded to the S3 bucket are automatically encrypted at rest using AWS KMS-managed keys. This protects sensitive data even if the uploader forgets to specify encryption, meeting security and compliance requirements for data-at-rest protection.

Answer

Configure a cross-origin resource sharing (CORS) policy.

Answer

Enable cross-region replication for the bucket.

Answer

Enable MFA Delete on the bucket to require multi-factor authentication for delete operations.

Question 7

Which THREE AWS services can be used to centrally manage and audit user permissions across multiple AWS accounts in AWS Organizations? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it logs API calls across all accounts in an organization and can be aggregated to a central account for auditing. AWS Organizations (D) is correct because it provides a central view of all accounts and allows you to apply service control policies (SCPs) to centrally manage permissions. AWS IAM Access Analyzer (E) is correct because it helps audit resources shared with external entities across accounts, identifying unintended access. Option A (AWS WAF) is incorrect because it is a web application firewall, not used for managing user permissions. Option C (AWS Config) is incorrect because it evaluates resource compliance, not user permissions.

Answer

AWS WAF

Answer

AWS Config

Question 8

A company has an AWS account with multiple VPCs connected via a transit gateway. The SysOps administrator needs to ensure that all traffic between VPCs is encrypted in transit. Which solution should the administrator implement?

Accepted Answer

Set up AWS Site-to-Site VPN connections between the VPCs via the transit gateway.. AWS Site-to-Site VPN connections between VPCs via a transit gateway can enforce IPsec encryption for all inter-VPC traffic. The transit gateway acts as a central hub, and each VPN connection encrypts traffic using IPsec tunnels, ensuring data confidentiality and integrity in transit. This meets the requirement for encrypted transit between VPCs without relying on third-party appliances.

Answer

Use VPC peering connections between the VPCs.

Answer

Use VPC endpoints to route traffic through AWS PrivateLink.

Answer

Configure network ACLs to deny unencrypted traffic.

Question 9

A SysOps administrator needs to provide temporary, limited-privilege credentials to an application running on an EC2 instance. The application needs to access an S3 bucket. What is the most secure way to grant these credentials?

Accepted Answer

Attach an IAM role with the necessary permissions to the EC2 instance.. Attaching an IAM role to an EC2 instance is the most secure method because it leverages the AWS Security Token Service (STS) to automatically rotate temporary credentials. The instance retrieves these credentials via the instance metadata service (IMDS), eliminating the need to hardcode, store, or manually manage long-term access keys. This approach follows the principle of least privilege and ensures credentials are automatically rotated and revoked when the role is detached.

Answer

Use a Lambda function to generate temporary credentials from an IAM user.

Answer

Store the AWS access keys in an S3 bucket and have the application download them at startup.

Answer

Create an IAM user with programmatic access and store the access keys in the application's environment variables.

Question 10

A company's security policy requires that all data stored in Amazon S3 must be encrypted at rest using keys managed by the company. Which encryption option should the SysOps administrator choose?

Accepted Answer

Server-Side Encryption with AWS KMS (SSE-KMS). Both options A (SSE-KMS) and C (SSE-C) meet the requirement because both allow the company to manage the encryption keys. With SSE-KMS, you can use a customer-managed customer master key (CMK) in AWS KMS, giving you control over key rotation and access. With SSE-C, you provide your own encryption key in each request, and S3 performs encryption and then discards the key. SSE-C is more cumbersome, so SSE-KMS with a customer-managed CMK is typically the preferred approach. Options B (SSE-S3) uses AWS-managed keys, and D (Client-Side Encryption) encrypts data before sending to S3, but the requirement is for server-side encryption with company-managed keys.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Client-Side Encryption

Question 11

A SysOps administrator is designing a VPC for a web application that must be secure. Which THREE security measures should the administrator implement? (Choose THREE.)

Accepted Answer

Configure network ACLs to filter traffic at the subnet level.. Network ACLs (NACLs) are stateless firewalls that operate at the subnet level, providing an additional layer of security by filtering traffic entering and exiting each subnet. By default, NACLs allow all traffic, but you can configure custom rules to explicitly allow or deny traffic based on IP addresses, protocols, and port ranges, which is essential for securing a web application VPC.

Answer

Place all resources in public subnets to simplify access.

Answer

Use the default VPC for simplicity.

Question 12

Which TWO AWS services can be used to encrypt data at rest in Amazon RDS? (Choose TWO.)

Accepted Answer

Amazon RDS encryption feature. Amazon RDS provides a built-in encryption feature that uses AWS KMS to encrypt data at rest. When you enable encryption for an RDS DB instance, the data stored on the underlying storage, automated backups, read replicas, and snapshots are encrypted using a KMS key. This feature is the primary method for encrypting data at rest in RDS, making option D correct.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Question 13

An organization has a requirement to prevent any IAM user from deleting an S3 bucket that contains critical data. The SysOps administrator needs to implement a preventive control that works even if the user has full administrative privileges. Which solution should the administrator implement?

Accepted Answer

Apply a service control policy (SCP) that denies s3:DeleteBucket for the account.. A Service Control Policy (SCP) is an AWS Organizations policy that can restrict permissions for all IAM users and roles within an account, including the root user. SCPs act as a preventive guardrail that overrides any IAM or bucket policies, so even a user with full administrative privileges (e.g., AdministratorAccess) cannot perform the denied action. This ensures that s3:DeleteBucket is blocked at the account level, providing a robust preventive control that cannot be bypassed by the user's own permissions.

Answer

Attach an IAM policy to the user that explicitly denies s3:DeleteBucket.

Answer

Enable MFA Delete on the bucket.

Answer

Add a bucket policy that denies s3:DeleteBucket for the user.

Question 14

A SysOps administrator must grant an IAM user the ability to start and stop specific EC2 instances, but NOT terminate them. The administrator creates a policy with the following statement. However, the user can still terminate instances. What is the MOST likely reason?

Accepted Answer

The policy does not restrict the ec2:TerminateInstances action to specific instances using a condition or ARN. EC2 actions like StopInstances and StartInstances require a resource-level permission on the instance, but TerminateInstances also requires a resource-level permission. The policy includes ec2:TerminateInstances with a condition, but if the condition is not met, the effect is Allow (since the condition is not satisfied, the statement might still allow termination if the condition is ignored). However, the key issue is that the policy uses ec2:ResourceTag as a condition key, which is valid, but the condition uses StringEquals, which requires the instance to have that tag. If the instance does not have the tag, the condition fails and the Allow does not apply, but there might be an implicit deny? Actually, the policy grants ec2:TerminateInstances with a condition that might not match, so the action is not allowed. But the user can still terminate, meaning the policy is too permissive. The most likely reason is that the policy allows ec2:TerminateInstances without proper resource restriction. Option B is incorrect because the condition key is correct. Option C is incorrect because termination is explicitly allowed with a condition. Option D is incorrect because the policy explicitly allows StartInstances and StopInstances.

Answer

The condition key ec2:ResourceTag is not a valid condition key for EC2 actions

Answer

The ec2:TerminateInstances action is not allowed in a customer-managed policy

Answer

The policy does not include an explicit deny for ec2:TerminateInstances

Question 15

A company requires that all access to the AWS Management Console be protected by multi-factor authentication (MFA). The SysOps administrator has enabled an IAM policy that denies all actions if the user does not authenticate with MFA. However, some users report they cannot list their own MFA devices. What is the MOST likely cause?

Accepted Answer

The policy denies the iam:ListMFADevices action without an MFA-authenticated session. The IAM policy that denies all actions unless the user is authenticated with MFA will also block the iam:ListMFADevices action because that API call is made without an MFA-authenticated session. When a user tries to list their own MFA devices, they have not yet passed the MFA challenge, so the session is not MFA-authenticated, and the deny policy applies. This creates a catch-22: the user cannot list their devices to manage MFA because listing requires MFA, but they need to list devices to set up MFA.

Answer

The policy is applied to the root user only

Answer

Users are not using MFA-enabled access keys

Answer

The policy is not applied in the us-east-1 region