SOA-C02 Security and Compliance Practice Test 14 — 15 Questions

Question 1

A company uses AWS KMS to encrypt EBS volumes attached to EC2 instances. The security team wants to ensure that only specific IAM roles can decrypt the volumes. Which configuration meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the KMS key policy to allow only specific IAM roles to use kms:Decrypt.. KMS key policies allow you to specify which IAM roles are allowed to use the key for decryption. Option A is wrong because service control policies (SCPs) are used to set permission boundaries across accounts in an organization, but they are not the most direct way to restrict decryption for specific IAM roles; KMS key policies are more appropriate. Option B is wrong because EBS volumes do not have bucket policies; bucket policies apply to S3 buckets. Option D is wrong because instance profiles and policies denying ec2:DetachVolume do not affect decryption permissions.

Answer

Use a service control policy to deny kms:Decrypt for all users.

Answer

Apply a bucket policy on the EBS snapshot bucket.

Answer

Attach an instance profile with a policy that denies ec2:DetachVolume.

Question 2

A SysOps administrator needs to audit all IAM user activity in the AWS account for the last 90 days. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM users, including console sign-in events, CLI commands, and SDK actions, and retains these logs for up to 90 days by default in the event history. This allows the SysOps administrator to audit all IAM user activity over the last 90 days without additional configuration.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 3

A company wants to provide temporary security credentials to a mobile application so it can access an S3 bucket. Which AWS service should be used to issue these credentials?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is specifically designed to generate temporary security credentials for users and applications. Option A is incorrect: Amazon Cognito can issue temporary credentials via identity pools, but STS is the direct service for temporary credentials. Option B is incorrect: AWS KMS manages encryption keys, not credentials. Option D is incorrect: IAM manages long-term user credentials, not temporary ones.

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Question 4

A SysOps administrator is asked to ensure that all objects in an S3 bucket are encrypted at rest using a customer-managed KMS key. The bucket currently has default encryption set to SSE-S3. What must be done to meet the requirement?

Accepted Answer

Update the bucket's default encryption to SSE-KMS using the customer-managed key, and re-upload existing objects.. Default encryption on an S3 bucket only applies to newly uploaded objects; existing objects remain encrypted with the previous method (SSE-S3). To ensure all objects are encrypted at rest with a customer-managed KMS key, you must update the bucket's default encryption to SSE-KMS with the desired key and then re-upload (or copy) existing objects so they inherit the new encryption setting. Simply changing the default encryption does not retroactively re-encrypt objects already stored.

Answer

Add a bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.

Answer

Apply a service control policy to enforce SSE-KMS across the organization.

Answer

Enable S3 Versioning and set the bucket's default encryption to SSE-KMS.

Question 5

A SysOps administrator needs to ensure that an Amazon RDS for MySQL database is compliant with PCI DSS requirements. Which THREE configurations should be implemented?

Accepted Answer

Require SSL/TLS connections to the database.. PCI DSS requires encryption of cardholder data transmitted over open, public networks. Enforcing SSL/TLS connections to an Amazon RDS for MySQL database ensures that all data in transit between clients and the database is encrypted, meeting Requirement 4 of the PCI DSS standard. This is a mandatory security control for protecting sensitive payment data during transmission.

Answer

Enable Multi-AZ deployment for high availability.

Answer

Configure automated backups with a retention period of 30 days.

Question 6

Refer to the exhibit. A SysOps administrator applies this S3 bucket policy to a bucket named 'my-bucket'. The root user of account 123456789012 attempts to upload an object to the bucket without specifying encryption. What will happen?

Accepted Answer

The upload is denied because the request does not meet the condition.. The policy allows s3:* actions only when the condition 's3:x-amz-server-side-encryption' equals 'aws:kms'. Since the root user uploads without specifying encryption, the condition is not met, resulting in an implicit deny. Therefore, option B is correct. Option A is wrong because even the root user must comply with the bucket policy; the policy does not grant unconditional full access. Option C is wrong because default encryption does not automatically add the required encryption header to the request. Option D is wrong because the policy does not explicitly deny all actions; it conditionally allows, and the request fails due to unmet condition.

Answer

The upload succeeds because the root user has full access.

Answer

The upload succeeds because the bucket has default encryption enabled.

Answer

The upload is denied because the policy explicitly denies all actions.

Question 7

A SysOps administrator is managing a multi-account AWS environment using AWS Organizations. The security team has mandated that all Amazon S3 buckets across all accounts must be encrypted with SSE-KMS using a centrally managed KMS key. The administrator has created a KMS key in the master account and enabled key rotation. The key policy allows the root user of each member account to use the key. However, users in member accounts report that they cannot upload objects to their S3 buckets with SSE-KMS using the central key, even though they have s3:PutObject permissions. The administrator verifies that the KMS key policy includes the necessary permissions for the member accounts. What should the administrator do to resolve the issue?

Accepted Answer

Attach an IAM policy to the users/roles in the member accounts that allows kms:GenerateDataKey using the central KMS key.. The key policy allows the root user of each member account, but IAM users/roles in those accounts still need explicit kms:GenerateDataKey permission to use the key for encryption. Option A is wrong because creating separate keys per account defeats the purpose of central management. Option B is wrong because the key policy already allows master account administration, which is not the issue. Option D is wrong because updating the bucket policy to require SSE-KMS does not grant the necessary KMS permissions.

Answer

Create a new KMS key in each member account and configure S3 bucket default encryption accordingly.

Answer

Ensure that the KMS key policy allows the master account to administer the key.

Answer

Update the S3 bucket policy to allow the s3:PutObject action only when encryption is set to SSE-KMS.

Question 8

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive user data in an S3 bucket. The security team requires that traffic between the ALB and the EC2 instances be encrypted, and that the EC2 instances only accept traffic from the ALB. Currently, the ALB terminates HTTPS and forwards HTTP to the instances. The SysOps administrator needs to implement the required security controls. Which solution should the administrator implement?

Accepted Answer

Configure the target group to use HTTPS protocol, install a TLS certificate on the EC2 instances, and update the security group on the instances to allow inbound traffic only from the ALB's security group.. Configuring the target group to use HTTPS ensures encryption between ALB and instances, and updating the security group to allow traffic only from the ALB's security group restricts access to only the ALB. Option A is incorrect because Global Accelerator does not directly encrypt traffic between ALB and instances and adds unnecessary complexity. Option B is incorrect because network ACLs are stateless and not suitable for this requirement; also, installing certificates via ACM on instances is not straightforward. Option C is incorrect because S3 VPC endpoint is for S3 access, not for encrypting ALB-to-instance traffic.

Answer

Use an AWS Global Accelerator to route traffic to the instances and enable encryption.

Answer

Create a network ACL that allows inbound HTTPS traffic from the ALB subnet and outbound HTTPS responses. Use AWS Certificate Manager to install a certificate on the instances.

Answer

Enable S3 VPC endpoint and configure the ALB to forward traffic to the instance via the endpoint.

Question 9

A SysOps administrator needs to ensure that all Amazon S3 buckets in an AWS account are encrypted at rest using server-side encryption. Which combination of actions should be taken to enforce this policy?

Accepted Answer

Use an S3 bucket policy on each bucket that denies s3:PutObject if the x-amz-server-side-encryption header is not present.. An S3 bucket policy with a Deny statement for s3:PutObject that requires the x-amz-server-side-encryption header ensures that any PUT request without encryption headers is rejected. This enforces server-side encryption at the point of upload, preventing unencrypted objects from being stored in the bucket. Default encryption (Option A) only applies encryption to objects that are uploaded without encryption headers, but it does not prevent unencrypted uploads; a bucket policy denial is the only way to block them outright.

Answer

Enable default encryption on each S3 bucket and create a CloudWatch alarm to notify if unencrypted objects are uploaded.

Answer

Use an S3 bucket policy with a Deny statement for s3:PutObject without encryption applied to all buckets via a single policy.

Answer

Use AWS CloudTrail to monitor PutObject calls and trigger an AWS Lambda function to delete unencrypted objects.

Question 10

A company is using AWS Organizations with multiple accounts. The security team wants to prevent any IAM user from creating access keys for themselves across all accounts. What is the most effective way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that denies iam:CreateAccessKey to all accounts in the organization.. Service control policies (SCPs) are the most effective way to enforce a guardrail across all accounts in an AWS Organization because they allow you to centrally deny or restrict permissions at the root, OU, or account level, overriding any IAM policies attached to users or roles. By applying an SCP that denies iam:CreateAccessKey, the security team ensures that no IAM user in any account within the organization can create access keys, regardless of their individual IAM policies. This approach is scalable and cannot be bypassed by account administrators, making it the correct choice for organization-wide enforcement.

Answer

Attach an IAM policy to the root user that denies iam:CreateAccessKey.

Answer

Configure an IAM password policy that requires strong passwords.

Answer

Use AWS CloudTrail to monitor and alert on CreateAccessKey events.

Question 11

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The company security policy requires that credentials are not stored on the instance. What is the most secure way to grant access?

Accepted Answer

Create an IAM role with S3 access permissions and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance via an instance profile allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS). These credentials are automatically rotated and never stored on the instance, satisfying the security policy requirement. The EC2 instance retrieves the credentials through the instance metadata service (IMDS), eliminating the need for long-term access keys.

Answer

Generate an access key and secret key for an IAM user, then store them in a configuration file on the instance.

Answer

Create an S3 bucket policy that allows access from the instance's public IP address.

Answer

Define the access keys as environment variables in the user data script when launching the instance.

Question 12

A SysOps administrator needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in an AWS account, including all IAM policy changes such as creating, updating, or deleting policies. CloudTrail captures these events as JSON logs, which can be stored in an S3 bucket for auditing and analysis. This makes it the appropriate tool for auditing changes to IAM policies.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3

Question 13

A company has an AWS account with multiple VPCs connected via a transit gateway. The security team wants to centrally manage VPC security group rules and ensure compliance. Which approach is most effective?

Accepted Answer

Use AWS Firewall Manager to centrally define and enforce security group rules across all VPCs.. AWS Firewall Manager is the correct choice because it provides centralized administration of security group rules across multiple VPCs and accounts, enabling the security team to define a common set of rules and automatically enforce compliance. It integrates with AWS Organizations to apply policies to all VPCs in the organization, ensuring consistent security posture without manual intervention.

Answer

Create a single security group and attach it to all VPCs.

Answer

Define security group rules in AWS CloudFormation templates and deploy them to each VPC.

Answer

Use network ACLs instead of security groups for centralized management.

Question 14

A company is using AWS KMS to encrypt data at rest. Which TWO actions can be taken to audit the usage of a customer managed key?

Accepted Answer

Enable AWS CloudTrail to log KMS API calls.. AWS CloudTrail captures all KMS API calls (e.g., Encrypt, Decrypt, GenerateDataKey) as events, providing a complete audit trail of who used the key, when, and from which source. By enabling CloudTrail, you can review these logs to audit customer managed key usage. This is the primary method for auditing KMS key operations.

Answer

Enable Amazon S3 server access logs to track KMS operations.

Answer

Use IAM Access Analyzer to review KMS key policies.

Answer

Use AWS Config rules to monitor KMS key usage.

Question 15

A SysOps administrator needs to ensure that an Amazon S3 bucket is not publicly accessible. Which THREE actions should be taken to prevent public access?

Accepted Answer

Configure the bucket to block new public ACLs using S3 Object Ownership.. Enabling S3 Object Ownership allows you to disable ACLs on the bucket, which prevents new public ACLs from being applied. This is a key step in ensuring that no objects can be made publicly accessible via ACLs, as ACLs are an older access control mechanism that can grant public read/write access.

Answer

Enable versioning on the bucket.

Answer

Delete the bucket policy if it exists.