SOA-C02 Security and Compliance Practice Test 12 — 15 Questions

Question 1

A company uses AWS CloudTrail to log all API calls. The security team requires that all logs be encrypted at rest and stored in an S3 bucket that blocks public access. The SysOps administrator configures the bucket with default encryption (SSE-S3) and a bucket policy that denies all actions unless the request includes the x-amz-server-side-encryption header with value AES256. However, CloudTrail delivery fails. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bucket policy requires the x-amz-server-side-encryption header, but CloudTrail does not include this header. CloudTrail does not include the x-amz-server-side-encryption header when delivering log files to S3. The bucket policy requires this header for all PutObject requests, so CloudTrail's PUT requests are denied, causing delivery to fail. SSE-S3 encryption is applied automatically by S3 when default encryption is enabled, but the policy condition overrides that by requiring the header explicitly.

Answer

CloudTrail does not support SSE-S3 encryption

Answer

The bucket policy does not grant CloudTrail the s3:PutObject permission

Answer

The bucket has default encryption enabled, which conflicts with CloudTrail's encryption

Question 2

A SysOps administrator needs to allow an IAM user to launch EC2 instances only in the us-east-1 region. The administrator creates a policy with a condition that uses the aws:RequestedRegion condition key. However, the user can still launch instances in other regions. What is the MOST likely reason?

Accepted Answer

The policy does not include the ec2:RunInstances action with the condition. The policy must explicitly deny or allow the ec2:RunInstances action with the aws:RequestedRegion condition. Without specifying the action, the condition key has no effect on the user's ability to launch instances. The policy likely only applies the condition to other actions or is missing the action entirely, allowing the user to bypass the region restriction.

Answer

The aws:RequestedRegion condition key is not supported for EC2

Answer

The condition key must be aws:Region instead of aws:RequestedRegion

Answer

The user has administrator access that overrides the policy

Question 3

A company uses AWS Key Management Service (KMS) to encrypt data in S3. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Use a KMS key policy with a condition that requires the encryption context to match the bucket ARN, and grant the IAM role decrypt permissions. It uses a KMS key policy with a condition that restricts decryption to requests where the encryption context matches the S3 bucket ARN. This ensures that only the specified IAM role, when making decrypt calls with the correct encryption context, can decrypt objects in that bucket. It directly ties the KMS key's decrypt permission to the bucket, providing a granular and secure access control mechanism.

Answer

Create a separate KMS key for each bucket and assign the IAM role as a key user

Answer

Configure an S3 bucket policy that allows only the IAM role to perform s3:GetObject

Answer

Use an S3 bucket policy that denies s3:GetObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header

Question 4

A company has a VPC with a public and private subnet. The security team wants to restrict outbound traffic from EC2 instances in the private subnet to only allow traffic to an S3 bucket in the same account. Which of the following is the MOST secure way to achieve this?

Accepted Answer

Configure a NAT gateway in the public subnet and update the route table to send traffic to the NAT gateway, then use security groups to restrict outbound traffic [wrong]. The question asks for the MOST secure way to restrict outbound traffic from private subnet EC2 instances to only an S3 bucket in the same account. Option D is the most secure because it uses a gateway VPC endpoint for S3, which keeps all traffic within the AWS network and does not require an internet gateway. The VPC endpoint policy restricts actions to the specific bucket, and the bucket policy allows only requests from the VPC endpoint, providing granular security. Option B also works by using a NAT gateway and security groups, but it requires traffic to go through the internet, which is less secure. Therefore, D is the best answer.

Answer

Use an internet gateway and a route table that directs traffic to the internet gateway, and use network ACLs to allow only S3 IP ranges [wrong]

Answer

Use a VPC endpoint for S3 and attach a security group to the endpoint that allows only HTTPS traffic to the S3 prefix list [wrong]

Question 5

A SysOps administrator is troubleshooting an issue where an IAM user cannot assume a role in another AWS account. The trust policy of the role allows the user's account to assume the role, and the user has a permissions policy that allows sts:AssumeRole. However, the user still gets an access denied error. What is the MOST likely cause?

Accepted Answer

The user's permissions policy does not include sts:AssumeRole for the specific role ARN. The most likely cause is that the user's IAM permissions policy grants sts:AssumeRole but does not specify the exact role ARN as the resource. Without the resource element limiting the action to the specific role, the policy may be too broad or missing the target role ARN, causing an implicit deny. AWS IAM requires that both the trust policy (on the role) and the permissions policy (on the user) explicitly allow the sts:AssumeRole action for the specific role ARN.

Answer

The trust policy specifies the user's ARN instead of the account ARN

Answer

The role requires MFA, but the user does not have MFA configured

Answer

The role's permissions policy does not include an external ID

Question 6

A company uses AWS Config to track resource changes. The security team wants to receive notifications whenever an IAM policy is changed. Which AWS service should be used with AWS Config to send notifications?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is the correct service to pair with AWS Config to send notifications when an IAM policy changes. AWS Config can publish configuration change events to an SNS topic, which then delivers notifications via email, SMS, or other protocols to the security team. This integration allows real-time alerting on resource changes without additional polling or custom logic.

Answer

Amazon CloudWatch Logs

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS CloudTrail

Question 7

A company has an S3 bucket that stores sensitive data. The security team requires that all access to the bucket be encrypted in transit. Which TWO actions should be taken to enforce this requirement? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm for any HTTP access. Enabling AWS CloudTrail to log all S3 API calls and setting up a CloudWatch alarm for any HTTP access allows the security team to detect and alert on any access that is not encrypted in transit (i.e., HTTP instead of HTTPS). This provides monitoring and incident response capability to enforce the encryption-in-transit requirement.

Answer

Enable default encryption (SSE-S3) on the bucket

Answer

Enable S3 Transfer Acceleration

Answer

Use S3 VPC endpoints

Question 8

A company wants to audit all AWS account activity for compliance. Which THREE AWS services should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can aggregate and store log data from various AWS services, including AWS CloudTrail and AWS Config. By centralizing CloudTrail's API activity logs and Config's configuration change logs into CloudWatch Logs, you can create metric filters and alarms to monitor compliance-related events in real time, enabling a comprehensive audit trail.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 9

Refer to the exhibit. An IAM user has this policy attached. The user tries to start an EC2 instance that has no tags. What will happen?

Accepted Answer

The user will be denied because the instance does not have the required tag. The IAM policy includes a condition that requires the EC2 instance to have a tag with key 'Environment' and value 'Production'. When the instance has no tags, the condition evaluates to false, and the default behavior for IAM policies is to deny access when a condition is not met. Since the policy does not explicitly allow the action without the tag, the request is implicitly denied.

Answer

The user will be allowed because the condition only applies if the tag exists

Answer

The user will be allowed because the resource ARN includes a wildcard

Answer

The user will be allowed because the policy does not explicitly deny the action

Question 10

Refer to the exhibit. The security team wants to ensure that all objects uploaded to the S3 bucket 'my-secure-bucket' are encrypted at rest. Based on the CloudTrail log entry, what can be concluded about the object 'confidential.pdf'?

Accepted Answer

The object is encrypted with SSE-S3. The CloudTrail log entry shows that the object 'confidential.pdf' was uploaded with the 'x-amz-server-side-encryption' header set to 'AES256'. This header indicates that server-side encryption with Amazon S3-managed keys (SSE-S3) was requested. The response also confirms that encryption was applied. Therefore, the object is encrypted with SSE-S3, making option C correct. Option A is incorrect because the log does not mention KMS key details. Option B is incorrect because the object is encrypted. Option D is incorrect because the encryption header was provided.

Answer

The object is encrypted with AWS KMS

Answer

The object is not encrypted

Answer

The object was uploaded without an encryption header

Question 11

Refer to the exhibit. An IAM role has the trust policy shown. Which entity can assume this role?

Accepted Answer

Any IAM user in the AWS account 123456789012. The trust policy specifies `"AWS": "arn:aws:iam::123456789012:root"` as the principal, which allows any IAM user or role within the AWS account 123456789012 to assume the role, provided they have the necessary permissions in their own identity-based policies. This is because the root ARN of an account acts as a wildcard for all identities in that account. Option C correctly identifies that any IAM user in that account can assume the role.

Answer

Only the IAM user with the ARN arn:aws:iam::123456789012:user/Admin

Answer

Any IAM user in any AWS account

Answer

Only users who have MFA enabled

Question 12

A company wants to enforce that all IAM users in an AWS account must use multi-factor authentication (MFA) to access the AWS Management Console. Which IAM policy effect should be used to deny access if MFA is not present?

Accepted Answer

Deny with a condition that aws:MultiFactorAuthPresent is false. The IAM policy must explicitly deny access when MFA is not present. By using a Deny effect with the condition aws:MultiFactorAuthPresent set to false, any request that does not include MFA authentication is blocked. This is the standard approach to enforce MFA usage, as IAM policies default to an implicit deny, but an explicit Deny overrides any Allow that might otherwise grant access.

Answer

Allow with a condition that aws:MultiFactorAuthPresent is false

Answer

Allow with a condition that aws:MultiFactorAuthPresent is true

Answer

Deny with a condition that aws:MultiFactorAuthPresent is true

Question 13

A SysOps administrator is investigating why an EC2 instance cannot access an S3 bucket using an IAM role. The instance has an associated IAM role with a policy that allows s3:GetObject on the bucket. The bucket policy also allows access from the role. However, the instance's application still gets access denied. What is the most likely cause?

Accepted Answer

The IAM role is not associated with the instance profile used by the EC2 instance. The most likely cause is that the IAM role is not properly associated with the instance profile used by the EC2 instance. For an EC2 instance to use an IAM role, the role must be attached to an instance profile, and that instance profile must be associated with the instance. Without this association, the instance lacks credentials to assume the role. Option A is incorrect because s3:GetObject does not require ListBucket permission unless the application needs to list objects. Option C is incorrect because the bucket policy allows access from the role, so an explicit deny is not the issue. Option D is incorrect because cross-region access to S3 does not require a VPC endpoint; the instance can access S3 over the internet.

Answer

The IAM role does not have s3:ListBucket permission

Answer

The bucket policy explicitly denies access to the role

Answer

The S3 bucket is in a different region, requiring a VPC endpoint

Question 14

A company uses AWS CloudTrail to log API calls. The SysOps team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and triggers an automated response. Which combination of services should be used? (Choose two.)

Accepted Answer

AWS Lambda. Amazon EventBridge (CloudWatch Events) can monitor CloudTrail API calls in real time and trigger an AWS Lambda function when a `StopLogging` or `UpdateTrail` API call is detected. Lambda then executes the automated response, such as re-enabling logging or sending an alert. This combination provides event-driven detection and remediation without manual intervention.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon Simple Queue Service (SQS)

Question 15

A company has an S3 bucket that contains sensitive customer data. The security team requires that all data in transit to and from the bucket must be encrypted. Which bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The correct condition is aws:SecureTransport, which ensures requests use HTTPS to encrypt data in transit. Option A is correct because it directly enforces transport encryption. Option B (s3:x-amz-server-side-encryption-aws-kms-key-id) is for encryption at rest using a specific KMS key, not in transit. Option C (s3:x-amz-server-side-encryption) is also for server-side encryption at rest. Option D (aws:TLSSupport) is not a valid AWS condition key. Therefore, only aws:SecureTransport meets the requirement for encrypting data in transit.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-server-side-encryption

Answer

aws:TLSSupport