SOA-C02 Security and Compliance Practice Test 13 — 15 Questions

Question 1

A SysOps administrator needs to grant an IAM user the ability to rotate their own access keys. What is the minimum set of permissions required?

Accepted Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey. The minimum permissions to allow an IAM user to rotate their own access keys are: iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, and iam:UpdateAccessKey. Option D is correct. Option A is wrong because it includes iam:PutUserPolicy, which is unnecessary for key rotation and grants additional permissions to modify user policies. Option B is wrong because it includes kms:*, which is unrelated to access key rotation and grants excessive permissions. Option C is wrong because it includes iam:GetUser, which is not required for rotating own keys; the user already knows their username or can be resolved via the policy variable.

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:PutUserPolicy

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, kms:*

Answer

iam:GetUser, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey

Question 2

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any member account can create access keys that are more than 90 days old. What is the most efficient way to enforce this?

Accepted Answer

Create an IAM policy that denies CreateAccessKey if the user has any key older than 90 days. An IAM policy attached to all users or groups can deny the iam:CreateAccessKey action if the user has any access key older than 90 days. This is achieved using the condition key 'iam:AccessKeyAge' with a numeric condition to check the age of the access key used to authenticate the request. If that key is older than 90 days, the request is denied. This prevents users with old keys from creating new ones, effectively enforcing rotation. While this requires per-account policy attachment, it is the most direct option among those given.

Answer

Use a service control policy (SCP) to deny the iam:CreateAccessKey action unless a condition is met

Answer

Use CloudTrail to monitor CreateAccessKey events and trigger a Lambda function to disable old keys

Answer

Use AWS Config rules in each account to detect keys older than 90 days and automatically delete them

Question 3

A company wants to use AWS KMS to encrypt data at rest for an S3 bucket. The security policy requires that the CMK be rotated every year. Which of the following are true about automatic key rotation for AWS KMS customer master keys (CMKs)? (Choose TWO.)

Accepted Answer

Automatic key rotation is supported for symmetric CMKs created in KMS. Automatic key rotation in AWS KMS is supported only for symmetric customer managed keys (CMKs) that are created in KMS (not imported). This makes option B correct. Additionally, automatic key rotation can be enabled at any time for such CMKs (e.g., after creation), so option C is also true when interpreted as 'any symmetric CMK created in KMS.' Options A, D, and E are false: asymmetric CMKs do not support automatic rotation, imported CMKs do not support automatic rotation, and old backing keys are retained after rotation, not deleted.

Answer

Automatic key rotation is supported for asymmetric CMKs

Answer

Automatic key rotation is supported for imported CMKs

Answer

When a CMK is rotated, the previous backing key is deleted

Question 4

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot pull secrets from AWS Secrets Manager. The instance has an IAM role with a policy that allows secretsmanager:GetSecretValue. The secret is in the same account and region. What are possible reasons for the failure? (Choose THREE.)

Accepted Answer

The EC2 instance is in a private subnet with no route to the internet or a VPC endpoint for Secrets Manager. If the EC2 instance is in a private subnet without a route to the internet (no NAT gateway or internet gateway) and no VPC endpoint for Secrets Manager, the instance cannot reach the Secrets Manager API endpoint. Secrets Manager requires network connectivity over HTTPS (port 443) to the service endpoint, and without either a public route or a VPC endpoint, the API calls will time out or fail with a connection error.

Answer

The secret is in a different AWS account

Answer

The IAM role is not attached to the instance profile

Question 5

A company uses AWS Shield Advanced to protect against DDoS attacks. Which of the following are benefits of AWS Shield Advanced? (Choose TWO.)

Accepted Answer

24/7 access to the DDoS Response Team (DRT). AWS Shield Advanced provides enhanced DDoS protection for resources like EC2, ELB, CloudFront, and Route 53 (option E), and includes 24/7 access to the DDoS Response Team (DRT) (option A). Option B is incorrect because Shield Advanced is not free; it has a monthly cost. Option C is incorrect because integration with AWS WAF is not a direct benefit of Shield Advanced; WAF is a separate service that can be used alongside Shield but is not a benefit of Shield Advanced itself. Option D is incorrect because automatic scaling is not a direct benefit of Shield Advanced; it is handled by other AWS services like Auto Scaling.

Answer

Free for all AWS accounts

Answer

Integration with AWS WAF to create custom rules

Answer

Automatic scaling of resources during an attack

Question 6

A SysOps administrator is configuring CloudTrail to log all management events and data events for S3 buckets. Which of the following are true about CloudTrail logging? (Choose THREE.)

Accepted Answer

CloudTrail logs include the identity of the user who made the API call. CloudTrail logs include the identity of the user or role that made the API call, captured as the `userIdentity` element in the log record. This element contains details such as the ARN, access key ID, and whether the call was made by an IAM user, federated user, or assumed role, enabling full auditability of who performed each action.

Answer

Data events for S3 are logged by default for all buckets

Answer

CloudTrail can log events for all AWS services automatically

Question 7

A company wants to use AWS WAF to protect a web application behind an Application Load Balancer. Which of the following can AWS WAF inspect? (Choose all that apply.)

Accepted Answer

HTTP headers. AWS WAF can inspect HTTP headers (option A), query string parameters (option B), request body of HTTPS requests (option D), and URI path (option E). All four options are correct. AWS WAF inspects the request body by default up to 8 KB for Application Load Balancer integrations, as TLS is terminated at the ALB.

Answer

SSL certificate of the client

Question 8

Refer to the exhibit. An IAM policy is attached to a user. What is the effective permission regarding the s3:DeleteObject action on the example-bucket?

Accepted Answer

Denied because of the explicit Deny statement. In IAM, an explicit Deny overrides any Allow. The first statement allows all S3 actions, but the second statement explicitly denies s3:DeleteObject. Therefore, the effective permission is Deny. Option A is correct because the explicit Deny takes precedence. Options B, C, and D are incorrect: B since an explicit Deny is present, it is not simply 'not allowed'; C because the order of statements does not matter; D because the Deny statement is valid despite the typo.

Answer

Denied because the action is not allowed explicitly

Answer

Allowed because the Allow statement is listed first

Answer

Allowed because the Deny statement has a typo

Question 9

Refer to the exhibit. A SysOps administrator runs the commands shown. Which key(s) have automatic key rotation enabled?

Accepted Answer

Only the first key. The first key has automatic key rotation enabled because the `EnableKeyRotation` API call was made specifically for that key (key ID `1234abcd-12ab-34cd-56ef-1234567890ab`). AWS KMS automatic key rotation is a per-key setting that must be explicitly enabled; it is not enabled by default. The second key (key ID `0987dcba-09fe-87dc-65ba-0987654321fe`) was not subjected to any rotation-enabling command, so it retains the default disabled state.

Answer

Only the second key

Answer

Neither key

Answer

Both keys

Question 10

Refer to the exhibit. An IAM policy allows running instances. A user attempts to launch a t2.micro instance with a 20 GiB gp2 volume and an additional 100 GiB io1 volume. What will happen?

Accepted Answer

The launch succeeds. The policy allows running t2.micro instances (first statement) and creating volumes (second statement) without restriction on volume type or size. However, the condition on the instance resource only restricts the instance type to t2.micro; the volume resource has no condition. Therefore, both volumes are allowed. The instance launch succeeds. Option A is correct. Options B, C, D are incorrect.

Answer

The launch fails because the policy does not allow creating volumes over 100 GiB

Answer

The launch fails because the condition does not allow any volume

Answer

The launch fails because the io1 volume is not allowed

Question 11

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used to track these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including all IAM policy changes such as CreatePolicy, PutUserPolicy, AttachRolePolicy, and DeletePolicy. CloudTrail logs these events with details like the user, source IP, and timestamp, providing a complete audit trail for security and compliance. AWS Config, while capable of tracking configuration changes, does not capture the API-level detail required for auditing who made the change and how.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Question 12

A SysOps administrator needs to grant a developer access to view only the logs of a specific Amazon RDS instance. Which IAM action should be allowed?

Accepted Answer

rds:DownloadDBLogFilePortion. `rds:DownloadDBLogFilePortion` grants permission to download and view the contents of a log file for a specific RDS instance. The question asks for the action to 'view only the logs', which requires retrieving the log file content. `rds:DescribeDBLogFiles` only lists available log files, not the actual log data. Therefore, to view logs, the developer needs the `DownloadDBLogFilePortion` permission.

Answer

rds:DescribeDBInstances

Answer

rds:DescribeDBLogFiles

Answer

rds:DescribeEvents

Question 13

A company has an S3 bucket configured with default encryption using SSE-S3. Users report that objects uploaded without specifying encryption are still encrypted, but some objects are accessible to unauthorized users. What is the most likely cause?

Accepted Answer

The bucket policy does not restrict access based on user permissions.. Default encryption only encrypts objects, it does not enforce access policies. Option A is wrong because bucket policies are needed for access control. Option C is wrong because enabling MFA Delete is about deletion, not access. Option D is wrong because public access block prevents public access, but the issue is unauthorized access from within the account or cross-account.

Answer

The bucket policy is not configured to deny unencrypted uploads.

Answer

The bucket does not have MFA Delete enabled.

Answer

The bucket's block public access settings are not configured.

Question 14

A SysOps administrator notices that an Amazon CloudWatch Logs log group is growing rapidly and suspects that an EC2 instance is sending sensitive data to the logs. What is the most effective way to detect and redact sensitive data in real-time?

Accepted Answer

Create a CloudWatch Logs subscription filter that invokes a Lambda function for redaction.. CloudWatch Logs subscription filters can invoke a Lambda function in real-time as log events are ingested. This allows the Lambda function to inspect, detect, and redact sensitive data (e.g., credit card numbers or passwords) before the logs are stored in the log group, meeting the requirement for real-time detection and redaction.

Answer

Use CloudWatch Logs Insights to query and mask sensitive data.

Answer

Enable S3 event notifications to trigger a Lambda function for redaction.

Answer

Send logs to Amazon Kinesis Data Firehose and use Lambda for redaction.

Question 15

A company wants to allow an external auditor to assume an IAM role in their AWS account to review resources. What is the minimum information the auditor needs from the company to do this?

Accepted Answer

The Amazon Resource Name (ARN) of the IAM role to assume.. The auditor needs the ARN of the IAM role to use the AWS STS AssumeRole API. This ARN uniquely identifies the role to assume. Option B is incorrect because sharing admin credentials violates security best practices and does not provide granular access. Option C is incorrect because the external auditor's account must already have permissions to assume the role; the role's trust policy, not the policy document, is what grants access. Option D is incorrect because the account ID is not enough; the role ARN is required.

Answer

The IAM user name and password of the company's admin user.

Answer

The IAM policy document that grants the auditor access.

Answer

The AWS account ID and the region where resources are hosted.