SOA-C02 Security and Compliance Practice Test 12 — 15 Questions

Question 1

A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS with a specific customer managed key. Which bucket policy condition should be used to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms", "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}. It uses both conditions: 's3:x-amz-server-side-encryption' set to 'aws:kms' ensures that objects are encrypted with SSE-KMS, and 's3:x-amz-server-side-encryption-aws-kms-key-id' set to the specific key ARN ensures that only the designated customer managed key is used. Option A enforces KMS encryption but does not restrict which KMS key, allowing any managed key. Option C enforces a specific key ARN but does not require the encryption header to be present, which could allow objects without encryption if the key ID header is omitted (though in practice, the key ID is only valid with SSE-KMS, the condition alone is not sufficient to guarantee encryption). Option D uses a 'Null' condition incorrectly and would not properly enforce encryption.

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}

Answer

"Condition": {"Null": {"s3:x-amz-server-side-encryption": "false"}}

Question 2

A SysOps administrator needs to ensure that an Amazon RDS instance is encrypted at rest. The instance is already provisioned unencrypted. What is the correct approach to enable encryption?

Accepted Answer

Create a snapshot of the instance and restore it with encryption enabled. RDS does not allow enabling encryption in place on an existing unencrypted instance. The supported path is to snapshot the instance, then restore that snapshot with encryption enabled, which produces a new encrypted instance. You then repoint applications to the new endpoint.

Answer

Use AWS KMS to encrypt the underlying EBS volumes of the RDS instance

Answer

Enable encryption using the AWS CLI command modify-db-instance

Answer

Modify the RDS instance and enable encryption in the configuration

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants to restrict all accounts from using specific AWS services unless explicitly allowed. Which feature should be used?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) in AWS Organizations define the maximum permissions for member accounts, allowing the security team to restrict which AWS services and actions are available across all accounts unless explicitly allowed. SCPs are applied at the organization, OU, or account level and act as a permissions guardrail that even account administrators cannot override.

Answer

Resource-based policies

Answer

IAM permissions boundaries

Answer

AWS Config rules

Question 4

An application running on Amazon EC2 needs to access an S3 bucket. The SysOps administrator wants to ensure that only that specific EC2 instance can access the bucket, without storing any long-term credentials on the instance. What is the most secure way to achieve this?

Accepted Answer

Attach an IAM role to the EC2 instance using an instance profile and grant the role S3 access. Attaching an IAM role to the EC2 instance via an instance profile allows the instance to obtain temporary credentials from the EC2 Instance Metadata Service (IMDS), which are automatically rotated. This eliminates the need to store long-term access keys on the instance and scopes permissions to the specific role. It is the AWS-recommended best practice for granting EC2 access to S3.

Answer

Configure a resource-based policy on the EC2 instance to allow S3 access

Answer

Create an IAM user with S3 access and store the access keys in the instance's user data

Answer

Generate pre-signed URLs for each S3 object the application needs to access

Question 5

A SysOps administrator needs to audit all API calls made in the AWS account, including actions performed by the root user. Which service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made in an AWS account, including those made by the root user, IAM users, roles, and AWS services. It provides a detailed audit trail of actions taken, which is essential for security and compliance auditing. Enabling CloudTrail in all regions ensures comprehensive coverage.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 6

A company requires that all S3 buckets be tagged with a 'CostCenter' tag. A SysOps administrator needs to enforce this and prevent creation of untagged buckets. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) that denies s3:CreateBucket unless the request includes the required tag. AWS Organizations SCPs can be used to deny actions that do not meet certain conditions, such as requiring specific tags. An SCP with a condition for 'aws:RequestTag' can enforce tagging at bucket creation. IAM policies can also enforce tagging for specific users, but SCPs apply to all accounts in the organization. AWS Config rules can detect non-compliant resources but cannot prevent creation. CloudTrail is for logging, not enforcement.

Answer

Create an IAM policy that allows s3:CreateBucket only if the bucket has the tag, and attach it to all users

Answer

Enable AWS CloudTrail to log bucket creation and review logs daily

Answer

Use an AWS Config rule to automatically delete untagged buckets

Question 7

A company wants to ensure that its AWS resources are compliant with the CIS AWS Foundations Benchmark. Which TWO AWS services can be used to automate compliance checks and remediation?

Accepted Answer

AWS Config. AWS Config (option C) is correct because it continuously records resource configuration changes and evaluates them against managed or custom rules, including CIS AWS Foundations Benchmark conformance packs, and it supports automatic remediation through SSM Automation documents. AWS Security Hub (option D) is correct because it aggregates security findings and runs the CIS AWS Foundations Benchmark as a supported security standard, giving a compliance score and control-level findings that can drive automated response via EventBridge. AWS CloudTrail (option A) only logs API activity for auditing and does not perform compliance evaluation or remediation. Amazon Inspector (option B) is a vulnerability management service for EC2, ECR images, and Lambda, not a CIS benchmark compliance engine. Amazon GuardDuty (option E) is a threat detection service that identifies malicious or anomalous activity, not configuration compliance against the CIS benchmark.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 8

A SysOps administrator is configuring a new VPC and wants to ensure that only traffic from a specific IP address range can access an EC2 instance via SSH. Which TWO components should be configured? (Choose two.)

Accepted Answer

Network ACL (NACL). To restrict SSH access to a specific IP range, you configure a network ACL at the subnet level and a security group at the instance level. NACLs are stateless and evaluate rules in order; security groups are stateful. Both can allow inbound SSH from the specific IP range. Internet gateway enables internet access but does not filter by IP. Route tables direct traffic but do not filter. VPC endpoint is for private connectivity to AWS services.

Answer

VPC endpoint

Answer

Internet gateway

Answer

Route table

Question 9

A SysOps administrator needs to ensure that all API calls made to AWS are logged for auditing purposes. Which AWS service should be enabled to capture management events?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service specifically designed to record API activity in an AWS account, including management events (control plane operations) such as creating, modifying, or deleting resources. It captures the identity of the caller, the time of the call, the source IP address, and other details, making it the correct choice for auditing API calls. CloudTrail logs can be delivered to an S3 bucket and optionally to CloudWatch Logs for further analysis.

Answer

S3 server access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 10

A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS with a specific customer managed key. Which bucket policy condition should be used to enforce this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms.. Adding a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms is the most efficient way to enforce encryption for future uploads. This policy prevents any upload without proper encryption. Option A is incorrect because SCPs (Service Control Policies) limit IAM permissions but do not directly enforce encryption on S3 objects. Option B is incorrect because AWS Config can detect unencrypted objects but does not automatically encrypt them; it is a reactive measure. Option D is incorrect because S3 default encryption can be overridden by the client specifying a different encryption header in the upload request.

Answer

Use an SCP to require KMS encryption for all S3 actions.

Answer

Use AWS Config to detect unencrypted objects and automatically encrypt them.

Answer

Enable S3 default encryption on the bucket with KMS.

Question 11

A SysOps administrator is troubleshooting an issue where an IAM user cannot launch an EC2 instance. The user has a policy that allows ec2:RunInstances. What is the most likely cause of the failure?

Accepted Answer

The user does not have permissions for supporting actions like CreateNetworkInterface.. Launching an EC2 instance requires more than just ec2:RunInstances — the principal also needs permissions for dependent actions such as ec2:CreateNetworkInterface, ec2:DescribeImages, ec2:DescribeSubnets, and ec2:DescribeSecurityGroups, depending on the launch configuration. If the policy only grants ec2:RunInstances, the launch fails with an UnauthorizedOperation error on the supporting action. This is the most likely cause given the scenario.

Answer

The user is not using multi-factor authentication (MFA).

Answer

The user does not have permission to use the KMS key for encryption.

Answer

The policy is attached to a group instead of the user.

Question 12

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which solution meets this requirement with minimal administrative overhead?

Accepted Answer

Create a new encrypted DB instance and migrate the data.. To encrypt data at rest in Amazon RDS for MySQL, encryption must be enabled at launch time; it cannot be added later. Therefore, the correct approach is to create a new encrypted DB instance and migrate the existing data (Option A). Option B (application-level encryption) adds administrative overhead and is not native to RDS. Option C is incorrect because encryption cannot be enabled on an existing instance; you must create a new one. Option D is incorrect because RDS does not use S3 for its primary storage; it uses Amazon EBS volumes.

Answer

Use application-level encryption to encrypt data before storing it in the DB.

Answer

Enable encryption on the existing DB instance by modifying the DB instance.

Answer

Store the data in an S3 bucket with encryption enabled and use RDS to access it.

Question 13

A company uses an IAM policy that allows s3:GetObject for a specific bucket. However, an IAM user is getting an Access Denied error when trying to download an object. The bucket policy also allows s3:GetObject for the user's account. What is the most likely cause?

Accepted Answer

The bucket policy has a Deny statement that applies to the user.. The most likely cause because if the bucket policy has a Deny statement that applies to the user, that explicit denial overrides any allow from the IAM policy or the bucket policy. Option A is incorrect because s3:GetObjectVersion is not required to download the current version; s3:GetObject is sufficient. Option C is incorrect because there is no indication that the object is encrypted with KMS, and even if it were, the error would be different (e.g., 'AccessDenied' due to missing KMS permissions, but the scenario explicitly says Access Denied from S3). Option D is incorrect because SCPs apply to the entire account, but the question states that both IAM and bucket policies allow access, so an SCP denial would be possible, but it is not the most likely cause given the explicit allow statements and the fact that a bucket-level Deny is more direct.

Answer

The IAM policy does not include the s3:GetObjectVersion action.

Answer

The object is encrypted with a customer-managed KMS key, and the user does not have kms:Decrypt permissions.

Answer

The user's account is part of an AWS Organization with an SCP that denies s3:GetObject.

Question 14

A SysOps administrator needs to generate a report of all IAM users and their last activity. Which AWS service can provide this information?

Accepted Answer

IAM Credential Report. IAM Credential Report provides a consolidated report of all IAM users and their last activity, including password last used and access key last rotated. Option A is incorrect because AWS Config tracks resource configuration changes, not user activity. Option C is incorrect because AWS Trusted Advisor provides cost optimization and security recommendations, not detailed user activity reports. Option D is incorrect because AWS CloudTrail logs API calls but does not generate a summarized report of user credentials.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 15

A company wants to ensure that an EC2 instance can access an S3 bucket without storing AWS credentials on the instance. What should the SysOps administrator do?

Accepted Answer

Create an IAM role with permissions to the S3 bucket and attach it to the EC2 instance profile.. An IAM role can be attached to an EC2 instance via an instance profile, granting temporary security credentials that allow the instance to access the S3 bucket without storing long-term credentials on the instance. Option B is incorrect because an S3 bucket policy cannot be attached to an instance; it is attached to the S3 bucket itself, and using the instance's public IP is not a secure or recommended method. Option C is incorrect because storing access keys on the instance violates the requirement of not storing credentials. Option D is incorrect because while AWS STS can generate temporary credentials, storing them in instance user data is not secure and does not eliminate credential storage on the instance.

Answer

Attach an S3 bucket policy that grants access to the EC2 instance's public IP address.

Answer

Generate access keys for an IAM user and store them on the instance.

Answer

Use AWS STS to generate temporary credentials and store them in the instance's user data.