SOA-C02 Security and Compliance Practice Test 14 — 15 Questions

Question 1

A company is using AWS CodePipeline to deploy a web application. The security team requires that all code changes be reviewed and approved before deployment to production. Which action should be taken to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a manual approval action in the CodePipeline pipeline before the production deployment stage.. Adding a manual approval action in the CodePipeline pipeline before the production deployment stage enforces a required review and approval gate. This action pauses the pipeline at that point, waiting for an authorized user to manually approve the change before it proceeds to the production stage, directly meeting the security team's requirement.

Answer

Create an IAM policy that denies the codecommit:PutFile action unless the user is in a specific group.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to notify the security team of any deployments.

Answer

Configure a CodeCommit repository to require pull requests for all changes.

Question 2

A company is using Amazon RDS for MySQL and needs to encrypt data at rest. Which action should be taken to enable encryption?

Accepted Answer

Create a new RDS DB instance with encryption enabled.. Amazon RDS for MySQL does not support enabling encryption on an existing DB instance. Encryption at rest must be enabled at the time of instance creation. Therefore, the correct action is to create a new RDS DB instance with encryption enabled, and then migrate the data from the unencrypted instance to the new encrypted one.

Answer

Use the RDS console to enable encryption on the existing DB instance.

Answer

Use AWS KMS to create a customer master key and assign it to the existing DB instance.

Answer

Modify the existing RDS DB instance and enable encryption.

Question 3

A company has a VPC with public and private subnets. The private subnets contain RDS databases that should not be accessible from the internet. Which configuration ensures that the databases are only accessible from the application servers in the public subnets?

Accepted Answer

Create a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers.. Security groups act as a virtual firewall at the instance level, and you can reference another security group as a source. By creating a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers, you ensure that only those application servers (regardless of their IP addresses) can reach the databases. This approach is more dynamic and secure than using CIDR-based rules, as it automatically accommodates changes in the application servers' IP addresses or scaling events.

Answer

Attach an internet gateway to the VPC and route the private subnet's traffic to it.

Answer

Attach a NAT gateway to the private subnet and route traffic through it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

Question 4

A company wants to monitor for unauthorized API calls in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, and timestamp of each call. This enables monitoring for unauthorized API activity by analyzing the logs for suspicious patterns or unexpected actions. CloudTrail is specifically designed for auditing API usage, unlike other services that focus on resource configuration or threat detection.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

Amazon GuardDuty

Question 5

Which TWO actions can be used to protect data in transit between an EC2 instance and an S3 bucket? (Choose two.)

Accepted Answer

Use HTTPS instead of HTTP when accessing S3 from the EC2 instance.. Option C is correct because using HTTPS (TLS) when accessing S3 from the EC2 instance encrypts the data in transit between the instance and S3, protecting it from interception or tampering on the network. Option E is correct because an S3 VPC endpoint (gateway endpoint for S3) keeps traffic between the VPC and S3 on the AWS private network, so it does not traverse the public internet, reducing exposure to interception. Option A is incorrect because security groups control which traffic is allowed to and from the instance but do not encrypt or otherwise protect the data in transit. Option B is incorrect because the x-amz-server-side-encryption header relates to server-side encryption of data at rest, not protection of data in transit. Option D is incorrect because S3 default encryption (SSE-S3) encrypts objects at rest in the bucket, not data moving between the EC2 instance and S3.

Answer

Configure security group rules on the EC2 instance to allow only S3 traffic.

Answer

Apply an S3 bucket policy that denies access unless the request includes the x-amz-server-side-encryption header.

Answer

Enable S3 default encryption (SSE-S3) on the bucket.

Question 6

Which TWO IAM policy conditions can be used to enforce multi-factor authentication (MFA) for API calls? (Choose two.)

Accepted Answer

aws:MultiFactorAuthPresent. Option B, aws:MultiFactorAuthPresent, is correct because this boolean condition key evaluates to true when the request is made with temporary credentials that were obtained through MFA, allowing a policy to explicitly deny or allow API calls based on whether MFA was used. Option C, aws:MultiFactorAuthAge, is correct because it checks the elapsed time (in seconds) since the MFA-authenticated session was established, enabling policies to require MFA to have occurred within a maximum age for API calls. Together these two conditions are the standard AWS mechanisms for enforcing MFA on API requests. Option A, aws:PrincipalType, only distinguishes between account, user, role, or federated principal types and does not indicate MFA usage. Option D, aws:TokenIssueTime, reflects when temporary credentials were issued but does not by itself prove MFA was performed. Option E, aws:SourceIp, restricts requests by source IP address and is unrelated to MFA enforcement.

Answer

aws:PrincipalType

Answer

aws:TokenIssueTime

Answer

aws:SourceIp

Question 7

An S3 bucket policy is shown in the exhibit. The AdminRole attempts to upload an object to my-bucket without specifying any server-side encryption header. What will happen?

Accepted Answer

The upload fails because the Deny statement denies PutObject without encryption.. The Deny statement denies PutObject when encryption is not aws:kms. Since the request has no encryption header, it does not equal aws:kms, so the Deny applies and the upload fails. The Allow statement allows the action only when encryption is aws:kms, so without encryption, it does not apply. Because the Deny overrides Allow, the upload is denied. Option A is wrong because the Allow does not apply. Option B is wrong because the Deny applies. Option C is wrong because the Deny does apply to the AdminRole.

Answer

The upload fails because the Allow statement requires encryption, but the Deny statement is evaluated first.

Answer

The upload succeeds because the Allow statement grants permission to the AdminRole.

Answer

The upload succeeds because the Deny statement does not apply to the AdminRole.

Question 8

A SysOps administrator needs to grant cross-account access to an S3 bucket in Account A for an IAM user in Account B. The bucket policy in Account A allows the IAM user's account root principal. What additional configuration is required?

Accepted Answer

Attach an IAM policy to the user in Account B that allows the required S3 actions. D is correct because cross-account access to an S3 bucket requires both a bucket policy that grants access to the root principal of the target account (Account B) and an IAM policy attached to the user in Account B that explicitly allows the desired S3 actions. Without the IAM policy, the user in Account B has no permissions to perform any S3 operations, even though the bucket policy in Account A permits the account root. The IAM policy acts as the identity-based permission that authorizes the specific user to invoke the S3 API calls.

Answer

Modify the AWS KMS key policy to allow the user in Account B

Answer

Add a bucket ACL granting access to the user in Account B

Answer

Add an AWS Organizations service control policy to allow access

Question 9

A SysOps administrator is troubleshooting an IAM policy that is not granting the expected permissions. The policy has a Deny effect on a specific action, but the user is still able to perform that action. What is the most likely reason?

Accepted Answer

The Deny statement includes a condition that is not met by the request. An explicit Deny in IAM only takes effect when the condition attached to that Deny statement evaluates to true for the request. If the Deny statement includes a condition (such as a specific IP range, MFA requirement, or time window) that the current request does not satisfy, the Deny does not apply, and an Allow from another policy can grant access. This is the most likely reason a user can still perform the action despite a Deny statement existing.

Answer

The Deny statement is listed after an Allow statement in the policy

Answer

IAM policies do not support deny statements with conditions

Answer

The user has an attached AWS managed policy that allows the action

Question 10

A company has an EC2 instance that needs to access an S3 bucket. The instance is launched in a private subnet with no internet gateway. What is the most secure way to provide access to S3 without traversing the internet?

Accepted Answer

Create an S3 VPC gateway endpoint. An S3 VPC gateway endpoint allows EC2 instances in a private subnet to access S3 privately using AWS’s internal network, without requiring an internet gateway, NAT gateway, or public IP. Traffic stays within the AWS backbone, never traversing the internet, which provides the most secure and cost-effective solution for this scenario.

Answer

Use a NAT gateway in a public subnet

Answer

Set up an AWS Direct Connect connection

Answer

Attach an internet gateway to the VPC and a public IP to the instance

Question 11

A SysOps administrator notices that an IAM user can access the AWS Management Console but cannot use the AWS CLI. The user has a password and an access key. What is the most likely cause?

Accepted Answer

The IAM policy denies CLI access unless MFA is present. The most likely cause is that the user's IAM policy includes a condition that denies CLI access unless MFA is present. The AWS CLI uses access keys for authentication, and if a policy explicitly requires MFA for API calls (e.g., via `aws:MultiFactorAuthPresent` condition key), CLI requests will be denied even though console access (which can enforce MFA separately via a sign-in policy) remains functional. This scenario is common when an administrator has attached a policy like `DenyAllExceptWithMFA` to the user or a group.

Answer

The secret access key was not saved during creation

Answer

The user's access key is inactive

Answer

The user is using the wrong password for the CLI

Question 12

A company wants to centrally manage access to AWS accounts for its employees. Which AWS service should be used to create and manage users and groups across multiple accounts?

Accepted Answer

AWS IAM Identity Center. AWS IAM Identity Center (successor to AWS SSO) allows you to centrally create and manage users and groups and assign them single sign-on access to multiple AWS accounts. Option C is correct. Option A (AWS IAM) is wrong because IAM is per-account and not designed for cross-account user management. Option B (AWS Directory Service) is wrong because it provides managed Microsoft Active Directory, not multi-account user management. Option D (AWS Organizations) is wrong because it manages accounts and policies, not users and groups.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS Organizations

Question 13

A company uses AWS KMS to encrypt EBS volumes. Which TWO statements about using KMS with EBS are correct? (Choose two.)

Accepted Answer

AWS managed KMS keys are automatically rotated each year. Option B is correct because AWS managed KMS keys (aws/ebs) are automatically rotated every year (approximately 365 days) with no manual action required. Option C is correct because EBS encryption can use either an AWS managed key (aws/ebs) or a customer managed KMS key that you create and control. Option A is incorrect because EBS encryption requires a symmetric KMS key, and imported key material is not supported for EBS volume encryption. Option D is incorrect because EBS encryption requires symmetric KMS keys; asymmetric KMS keys are not supported for EBS volume encryption. Option E is incorrect because when you create a snapshot, the encryption key is inherited from the source volume (or from the default EBS KMS key if the volume is unencrypted), so you are not required to specify a KMS key at snapshot creation time.

Answer

You can import key material for EBS encryption

Answer

EBS supports asymmetric KMS keys

Answer

You must specify a KMS key when creating a snapshot

Question 14

Which THREE security best practices should be followed when managing IAM users? (Choose three.)

Accepted Answer

Rotate access keys regularly. Rotating access keys regularly limits the window of exposure if a key is compromised. AWS recommends rotating IAM user access keys every 90 days as a security best practice, and this can be enforced using an IAM policy that checks the key's creation date via the `aws:CurrentTime` condition key.

Answer

Attach policies directly to users

Answer

Use the root user for daily administration

Question 15

Refer to the exhibit. A SysOps administrator reviews the account password policy. Which of the following is true based on this output?

Accepted Answer

Users cannot reuse their last 5 passwords. The output shows MaxPasswordAge: 90 and ExpirePasswords: true, meaning passwords expire after 90 days. PasswordReusePrevention: 5 means users cannot reuse the last 5 passwords. Option B is correct. Option A is wrong because password expiration is enabled (ExpirePasswords: true). Option C is wrong because MaximumPasswordAge is 90 days. Option D is wrong because HardExpiry is false, meaning users can change expired passwords.

Answer

Passwords do not expire

Answer

The maximum password age is 120 days

Answer

Users cannot change expired passwords