SOA-C02 Security and Compliance Practice Test 14 — 15 Questions

Question 1

A company's security policy requires that all data stored in Amazon S3 must be encrypted at rest using keys managed by the company. Which encryption option should the SysOps administrator choose?

Accepted Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C). Option D is correct because SSE-C allows the customer to provide their own encryption keys. Option A is wrong because SSE-S3 uses AWS-managed keys. Option B is wrong because SSE-KMS uses AWS KMS-managed keys. Option C is wrong because client-side encryption is managed by the client, but not at-rest encryption managed by AWS.

Answer

Server-Side Encryption with AWS KMS (SSE-KMS)

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Client-Side Encryption

Question 2

A SysOps administrator is designing a VPC for a web application that must be secure. Which THREE security measures should the administrator implement? (Choose THREE.)

Accepted Answer

Configure network ACLs to filter traffic at the subnet level.. Option A is correct because security groups act as virtual firewalls. Option C is correct because NACLs provide an additional layer of security at the subnet level. Option E is correct because VPC Flow Logs help monitor traffic. Option B is wrong because public subnets are not required for web applications. Option D is wrong because default VPC may not be secure.

Answer

Place all resources in public subnets to simplify access.

Answer

Use the default VPC for simplicity.

Question 3

Which TWO AWS services can be used to encrypt data at rest in Amazon RDS? (Choose TWO.)

Accepted Answer

Amazon RDS encryption feature. Option B is correct because AWS KMS can be used to manage keys for RDS encryption. Option C is correct because RDS supports encryption at rest using AWS KMS. Option A is wrong because AWS Certificate Manager is for SSL/TLS certificates. Option D is wrong because CloudHSM is a hardware security module but not directly integrated with RDS for encryption at rest. Option E is wrong because IAM is for access control.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Question 4

An organization has a requirement to prevent any IAM user from deleting an S3 bucket that contains critical data. The SysOps administrator needs to implement a preventive control that works even if the user has full administrative privileges. Which solution should the administrator implement?

Accepted Answer

Apply a service control policy (SCP) that denies s3:DeleteBucket for the account.. Option D is correct because an SCP can deny the s3:DeleteBucket action at the organizational level, overriding any allow. Option A is wrong because an IAM policy with deny can be overridden if the user has admin privileges (except with explicit deny, but if the user has full admin, they might have permissions to change policy). Option B is wrong because bucket policies cannot prevent IAM users from deleting the bucket if they have s3:DeleteBucket permission. Option C is wrong because MFA delete only applies to objects, not bucket deletion.

Answer

Attach an IAM policy to the user that explicitly denies s3:DeleteBucket.

Answer

Enable MFA Delete on the bucket.

Answer

Add a bucket policy that denies s3:DeleteBucket for the user.

Question 5

A company uses S3 to store sensitive data. To meet compliance requirements, all S3 buckets must be encrypted at rest. The security team notices that some objects in a bucket are not encrypted. What is the MOST efficient way to enforce encryption for all future objects?

Accepted Answer

Create an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption header is not present. Option D is correct because using a bucket policy to deny PutObject requests without the x-amz-server-side-encryption header ensures that any object uploaded without encryption is rejected. Option A is incorrect because S3 default encryption applies only to new objects, but objects can still be uploaded without encryption if the request explicitly specifies otherwise. Option B is incorrect because S3 inventory does not enforce encryption; it only reports. Option C is incorrect because manually re-uploading is not efficient and does not prevent future violations.

Answer

Use AWS Config managed rule to identify unencrypted objects and re-upload them manually

Answer

Use S3 Inventory to list unencrypted objects and apply encryption via S3 Batch Operations

Answer

Enable default encryption on the bucket using AES-256

Question 6

A SysOps administrator must grant an IAM user the ability to start and stop specific EC2 instances, but NOT terminate them. The administrator creates a policy with the following statement. However, the user can still terminate instances. What is the MOST likely reason?

Accepted Answer

The policy does not restrict the ec2:TerminateInstances action to specific instances using a condition or ARN. Option A is correct because EC2 actions like StopInstances and StartInstances require a resource-level permission on the instance, but TerminateInstances also requires a resource-level permission. The policy includes ec2:TerminateInstances with a condition, but if the condition is not met, the effect is Allow (since the condition is not satisfied, the statement might still allow termination if the condition is ignored). However, the key issue is that the policy uses ec2:ResourceTag as a condition key, which is valid, but the condition uses StringEquals, which requires the instance to have that tag. If the instance does not have the tag, the condition fails and the Allow does not apply, but there might be an implicit deny? Actually, the policy grants ec2:TerminateInstances with a condition that might not match, so the action is not allowed. But the user can still terminate, meaning the policy is too permissive. The most likely reason is that the policy allows ec2:TerminateInstances without proper resource restriction. Option B is incorrect because the condition key is correct. Option C is incorrect because termination is explicitly allowed with a condition. Option D is incorrect because the policy explicitly allows StartInstances and StopInstances.

Answer

The condition key ec2:ResourceTag is not a valid condition key for EC2 actions

Answer

The ec2:TerminateInstances action is not allowed in a customer-managed policy

Answer

The policy does not include an explicit deny for ec2:TerminateInstances

Question 7

A company requires that all access to the AWS Management Console be protected by multi-factor authentication (MFA). The SysOps administrator has enabled an IAM policy that denies all actions if the user does not authenticate with MFA. However, some users report they cannot list their own MFA devices. What is the MOST likely cause?

Accepted Answer

The policy denies the iam:ListMFADevices action without an MFA-authenticated session. Option B is correct because the policy that denies actions without MFA also blocks the action to list MFA devices, which is needed to set up MFA. The policy should include an exception for the iam:ListMFADevices action. Option A is incorrect because the problem is not that users are not using MFA; it's that they cannot list devices to set up MFA. Option C is incorrect because the policy is not limited to a specific region. Option D is incorrect because IAM is not region-specific.

Answer

The policy is applied to the root user only

Answer

Users are not using MFA-enabled access keys

Answer

The policy is not applied in the us-east-1 region

Question 8

A company uses AWS CloudTrail to log all API calls. The security team requires that all logs be encrypted at rest and stored in an S3 bucket that blocks public access. The SysOps administrator configures the bucket with default encryption (SSE-S3) and a bucket policy that denies all actions unless the request includes the x-amz-server-side-encryption header with value AES256. However, CloudTrail delivery fails. What is the MOST likely cause?

Accepted Answer

The bucket policy requires the x-amz-server-side-encryption header, but CloudTrail does not include this header. Option C is correct because CloudTrail delivers logs using SSE-S3 by default, but it does not include the x-amz-server-side-encryption header in the PutObject requests. The bucket policy requires that header, so the requests are denied. Option A is incorrect because CloudTrail can deliver to buckets with default encryption. Option B is incorrect because the bucket policy does not need to allow CloudTrail explicitly; the service has permissions via the trail's bucket policy. Option D is incorrect because SSE-S3 is supported by CloudTrail.

Answer

CloudTrail does not support SSE-S3 encryption

Answer

The bucket policy does not grant CloudTrail the s3:PutObject permission

Answer

The bucket has default encryption enabled, which conflicts with CloudTrail's encryption

Question 9

A SysOps administrator needs to allow an IAM user to launch EC2 instances only in the us-east-1 region. The administrator creates a policy with a condition that uses the aws:RequestedRegion condition key. However, the user can still launch instances in other regions. What is the MOST likely reason?

Accepted Answer

The policy does not include the ec2:RunInstances action with the condition. Option A is correct because the ec2:RunInstances action is global; the aws:RequestedRegion condition works only for regional service endpoints. Some EC2 actions are global, and the condition may not apply. However, the primary reason is that the condition key aws:RequestedRegion is evaluated only for regional service calls; if the user uses a global endpoint, the condition might not match. But more commonly, the policy might not include the condition for all EC2 actions. Option B is incorrect because the condition key is valid. Option C is incorrect because the policy can restrict to a region. Option D is incorrect because the condition is available.

Answer

The aws:RequestedRegion condition key is not supported for EC2

Answer

The condition key must be aws:Region instead of aws:RequestedRegion

Answer

The user has administrator access that overrides the policy

Question 10

A company uses AWS Key Management Service (KMS) to encrypt data in S3. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Use a KMS key policy with a condition that requires the encryption context to match the bucket ARN, and grant the IAM role decrypt permissions. Option B is correct because by adding a condition in the KMS key policy that requires the encryption context to match the bucket name, you can restrict decryption to only requests that include that context. The IAM role can then be allowed to use the key with that context. Option A is incorrect because bucket policies cannot restrict decrypt actions; they can only enforce encryption. Option C is incorrect because S3 bucket policies do not control KMS decrypt permissions. Option D is incorrect because using a different key for each bucket is cumbersome and does not restrict to a specific role.

Answer

Create a separate KMS key for each bucket and assign the IAM role as a key user

Answer

Configure an S3 bucket policy that allows only the IAM role to perform s3:GetObject

Answer

Use an S3 bucket policy that denies s3:GetObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header

Question 11

A company has a VPC with a public and private subnet. The security team wants to restrict outbound traffic from EC2 instances in the private subnet to only allow traffic to an S3 bucket in the same account. Which of the following is the MOST secure way to achieve this?

Accepted Answer

Create a gateway VPC endpoint for S3, attach a bucket policy that allows access only from the VPC endpoint, and use a VPC endpoint policy to restrict actions to the specific bucket. Option D is correct because using a gateway VPC endpoint for S3 with a bucket policy that allows only the VPC's endpoint ID ensures that traffic can only come from within the VPC. Additionally, a VPC endpoint policy can restrict actions to the specific bucket. Option A is incorrect because NAT gateways allow all outbound traffic, not just to S3. Option B is incorrect because security groups cannot filter based on S3 bucket names. Option C is incorrect because an internet gateway would allow general outbound traffic.

Answer

Use an internet gateway and a route table that directs traffic to the internet gateway, and use network ACLs to allow only S3 IP ranges

Answer

Configure a NAT gateway in the public subnet and update the route table to send traffic to the NAT gateway, then use security groups to restrict outbound traffic

Answer

Use a VPC endpoint for S3 and attach a security group to the endpoint that allows only HTTPS traffic to the S3 prefix list

Question 12

A SysOps administrator is troubleshooting an issue where an IAM user cannot assume a role in another AWS account. The trust policy of the role allows the user's account to assume the role, and the user has a permissions policy that allows sts:AssumeRole. However, the user still gets an access denied error. What is the MOST likely cause?

Accepted Answer

The user's permissions policy does not include sts:AssumeRole for the specific role ARN. Option C is correct because even if the trust policy allows the account, the role's permissions policy must grant the user the necessary actions. In this case, the role's permissions policy might not include the required permissions for the services the user is trying to use after assuming the role. However, the question is about the error being access denied at the AssumeRole call itself. That would be due to the trust policy or the user's permissions. Option A is incorrect because MFA is not mentioned. Option B is incorrect because the role's trust policy allows the account. Option D is incorrect because external ID is optional.

Answer

The trust policy specifies the user's ARN instead of the account ARN

Answer

The role requires MFA, but the user does not have MFA configured

Answer

The role's permissions policy does not include an external ID

Question 13

A company uses AWS Config to track resource changes. The security team wants to receive notifications whenever an IAM policy is changed. Which AWS service should be used with AWS Config to send notifications?

Accepted Answer

Amazon Simple Notification Service (SNS). Option D is correct because AWS Config can send configuration change notifications to Amazon SNS, which can then trigger emails or other notifications. Option A is incorrect because CloudWatch Logs is for log data, not notifications. Option B is incorrect because CloudTrail is for API activity, not configuration changes. Option C is incorrect because SQS is a queue, not a notification service.

Answer

Amazon CloudWatch Logs

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS CloudTrail

Question 14

A company has an S3 bucket that stores sensitive data. The security team requires that all access to the bucket be encrypted in transit. Which TWO actions should be taken to enforce this requirement? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm for any HTTP access. Options A and C are correct. A bucket policy that denies requests without HTTPS ensures all access uses TLS. AWS CloudTrail can be used to monitor and detect HTTP requests, though it does not enforce. Option B is incorrect because enabling default encryption does not enforce in-transit encryption. Option D is incorrect because S3 Transfer Acceleration does not enforce HTTPS; it uses TLS but does not prevent HTTP. Option E is incorrect because S3 endpoints support HTTPS, but the bucket policy is needed to enforce.

Answer

Enable default encryption (SSE-S3) on the bucket

Answer

Enable S3 Transfer Acceleration

Answer

Use S3 VPC endpoints

Question 15

A company wants to audit all AWS account activity for compliance. Which THREE AWS services should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. Options A, B, and E are correct. AWS CloudTrail records API activity, Amazon CloudWatch Logs can store logs, and AWS Config tracks resource configuration changes. Option C is incorrect because AWS Trusted Advisor is for recommendations, not auditing. Option D is incorrect because Amazon GuardDuty is for threat detection.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty