SOA-C02 Security and Compliance Practice Test 15 — 15 Questions

Question 1

A SysOps administrator needs to restrict access to an S3 bucket so that only users from the corporate network IP range (203.0.113.0/24) can read objects. Which TWO elements are required to implement this? (Choose two.)

Accepted Answer

The S3 endpoint URL (s3.amazonaws.com) accessible from the corporate network. Options A and B are correct. A bucket policy can use the aws:SourceIp condition to restrict access to the IP range. Additionally, if the users are accessing via the internet, they must use the S3 endpoint. Option C is incorrect because VPC endpoints are for private connectivity, but the condition would be different. Option D is incorrect because IAM policies are for user permissions, not IP restrictions. Option E is incorrect because CloudFront is a CDN, not required.

Answer

An IAM policy that allows s3:GetObject from the corporate IP

Answer

Amazon CloudFront distribution with an origin access identity

Answer

A VPC gateway endpoint for S3

Question 2

Refer to the exhibit. An IAM user has this policy attached. The user tries to start an EC2 instance that has no tags. What will happen?

Accepted Answer

The user will be denied because the instance does not have the required tag. Option A is correct because the policy allows actions only on instances with the tag Environment=Production. Since the instance has no tags, the condition is not met, and the action is not allowed. The user will be denied. Option B is incorrect because the condition uses StringEquals, which requires the tag to exist and match. Option C is incorrect because without the tag, the condition fails, resulting in implicit deny. Option D is incorrect because the policy does not allow all instances; it has a condition.

Answer

The user will be allowed because the condition only applies if the tag exists

Answer

The user will be allowed because the resource ARN includes a wildcard

Answer

The user will be allowed because the policy does not explicitly deny the action

Question 3

Refer to the exhibit. The security team wants to ensure that all objects uploaded to the S3 bucket 'my-secure-bucket' are encrypted at rest. Based on the CloudTrail log entry, what can be concluded about the object 'confidential.pdf'?

Accepted Answer

The object is encrypted with SSE-S3. Option D is correct because the requestParameters show that the object was uploaded with the x-amz-server-side-encryption header set to AES256, and the response confirms encryption was applied. Option A is incorrect because the log does not indicate the key used; it could be SSE-S3. Option B is incorrect because the object is encrypted, as shown. Option C is incorrect because the log shows the encryption header was provided.

Answer

The object is encrypted with AWS KMS

Answer

The object is not encrypted

Answer

The object was uploaded without an encryption header

Question 4

Refer to the exhibit. An IAM role has the trust policy shown. Which entity can assume this role?

Accepted Answer

Any IAM user in the AWS account 123456789012. Option B is correct because the trust policy allows the root user of the same account (arn:aws:iam::123456789012:root) to assume the role. This includes all IAM users in that account. Option A is incorrect because the policy does not specify any user ARN. Option C is incorrect because the policy does not allow external accounts. Option D is incorrect because the condition is empty and does not require MFA.

Answer

Only the IAM user with the ARN arn:aws:iam::123456789012:user/Admin

Answer

Any IAM user in any AWS account

Answer

Only users who have MFA enabled

Question 5

A company wants to enforce that all IAM users in an AWS account must use multi-factor authentication (MFA) to access the AWS Management Console. Which IAM policy effect should be used to deny access if MFA is not present?

Accepted Answer

Deny with a condition that aws:MultiFactorAuthPresent is false. The correct approach is to use a Deny effect in a condition that checks if MFA is present. Option B is correct because it denies access when the condition 'aws:MultiFactorAuthPresent' is false. Option A is wrong because Allow would grant access even without MFA. Option C is wrong because it allows access only when MFA is present, but does not deny when missing. Option D is wrong because it allows access when MFA is not present.

Answer

Allow with a condition that aws:MultiFactorAuthPresent is false

Answer

Allow with a condition that aws:MultiFactorAuthPresent is true

Answer

Deny with a condition that aws:MultiFactorAuthPresent is true

Question 6

A SysOps administrator is investigating why an EC2 instance cannot access an S3 bucket using an IAM role. The instance has an associated IAM role with a policy that allows s3:GetObject on the bucket. The bucket policy also allows access from the role. However, the instance's application still gets access denied. What is the most likely cause?

Accepted Answer

The IAM role is not associated with the instance profile used by the EC2 instance. The instance profile must be correctly attached to the EC2 instance. Option C is correct because if the role is not properly associated with the instance profile, the instance will not have the necessary credentials. Option A is wrong because the S3 endpoint is not required for access via the internet. Option B is wrong because the bucket policy allows the role. Option D is wrong because the role already has the GetObject permission.

Answer

The IAM role does not have s3:ListBucket permission

Answer

The bucket policy explicitly denies access to the role

Answer

The S3 bucket is in a different region, requiring a VPC endpoint

Question 7

A company uses AWS CloudTrail to log API calls. The SysOps team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and triggers an automated response. Which combination of services should be used? (Choose two.)

Accepted Answer

AWS Lambda. The correct answer is A and D. CloudWatch Events (Amazon EventBridge) can match a pattern for StopLogging API calls and trigger a Lambda function to take corrective action (e.g., re-enable logging). Options B and C are wrong because AWS Config records resource changes but is not real-time for event-driven responses. Option E is wrong because SQS alone does not process events.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon Simple Queue Service (SQS)

Question 8

A company has an S3 bucket that contains sensitive customer data. The security team requires that all data in transit to and from the bucket must be encrypted. Which bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The correct condition is aws:SecureTransport, which checks if the request was sent over HTTPS. Option C is correct. Option A is wrong because it checks for encryption at rest. Option B is wrong because it checks for TLS version. Option D is wrong because it checks for a specific cipher.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-server-side-encryption

Answer

aws:TLSSupport

Question 9

A SysOps administrator needs to grant an IAM user the ability to rotate their own access keys. What is the minimum set of permissions required?

Accepted Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey. The minimum permissions are iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, and iam:UpdateAccessKey. Option B is correct. Option A is wrong because it includes iam:PutUserPolicy which is unnecessary. Option C is wrong because it grants global key management. Option D is wrong because it includes iam:GetUser which is not needed.

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:PutUserPolicy

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, kms:*

Answer

iam:GetUser, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey

Question 10

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any member account can create access keys that are more than 90 days old. What is the most efficient way to enforce this?

Accepted Answer

Use a service control policy (SCP) to deny the iam:CreateAccessKey action unless a condition is met. The most efficient way is to use a service control policy (SCP) that denies the creation of access keys if the user does not have an existing key older than 90 days, or by using a condition on the CreateAccessKey action. Option D is correct. Option A is wrong because it requires per-account Config rules. Option B is wrong because CloudTrail does not enforce. Option C is wrong because it is reactive, not preventive.

Answer

Use CloudTrail to monitor CreateAccessKey events and trigger a Lambda function to disable old keys

Answer

Use AWS Config rules in each account to detect keys older than 90 days and automatically delete them

Answer

Create an IAM policy that denies CreateAccessKey if the user has any key older than 90 days

Question 11

A company wants to use AWS KMS to encrypt data at rest for an S3 bucket. The security policy requires that the CMK be rotated every year. Which of the following are true about automatic key rotation for AWS KMS customer master keys (CMKs)? (Choose TWO.)

Accepted Answer

Automatic key rotation is supported for symmetric CMKs created in KMS. Automatic key rotation is supported only for symmetric CMKs created in KMS (option B). It is not supported for asymmetric CMKs (option A) or imported keys (option C). Option D is wrong because rotation creates new backing keys but does not delete old ones. Option E is wrong because rotation is not automatic for imported keys.

Answer

Automatic key rotation is supported for asymmetric CMKs

Answer

Automatic key rotation can be enabled for any CMK at any time

Answer

Automatic key rotation is supported for imported CMKs

Answer

When a CMK is rotated, the previous backing key is deleted

Question 12

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot pull secrets from AWS Secrets Manager. The instance has an IAM role with a policy that allows secretsmanager:GetSecretValue. The secret is in the same account and region. What are possible reasons for the failure? (Choose THREE.)

Accepted Answer

The EC2 instance is in a private subnet with no route to the internet or a VPC endpoint for Secrets Manager. Possible reasons include: the secret is encrypted with a KMS CMK that the role does not have access to (A), the VPC endpoint policy for Secrets Manager denies the action (B), and the instance is in a private subnet without a VPC endpoint or NAT gateway (C). Option D is wrong because cross-account is not needed. Option E is wrong because the instance profile is already associated with the role.

Answer

The secret is in a different AWS account

Answer

The IAM role is not attached to the instance profile

Question 13

A company uses AWS Shield Advanced to protect against DDoS attacks. Which of the following are benefits of AWS Shield Advanced? (Choose TWO.)

Accepted Answer

24/7 access to the DDoS Response Team (DRT). AWS Shield Advanced provides enhanced DDoS protection and access to the DDoS Response Team (DRT) (options A and B). Option C is wrong because Shield Advanced is not free; it has a cost. Option D is wrong because automatic scaling is not a direct benefit of Shield. Option E is wrong because WAF is a separate service.

Answer

Free for all AWS accounts

Answer

Integration with AWS WAF to create custom rules

Answer

Automatic scaling of resources during an attack

Question 14

A SysOps administrator is configuring CloudTrail to log all management events and data events for S3 buckets. Which of the following are true about CloudTrail logging? (Choose THREE.)

Accepted Answer

CloudTrail logs include the identity of the user who made the API call. Data events for S3 can be logged, but they incur additional costs (option A). Management events are logged by default (option B). CloudTrail cannot log events across all AWS services automatically; it must be configured per service (option C is wrong). Option D is correct because CloudTrail logs include API caller identity. Option E is correct because logs can be delivered to CloudWatch Logs.

Answer

Data events for S3 are logged by default for all buckets

Answer

CloudTrail can log events for all AWS services automatically

Question 15

A company wants to use AWS WAF to protect a web application behind an Application Load Balancer. Which of the following can AWS WAF inspect? (Choose THREE.)

Accepted Answer

HTTP headers. AWS WAF can inspect HTTP headers (A), URI paths (B), and query string parameters (C). Option D is wrong because WAF does not inspect the body of HTTPS requests by default; it can inspect the body if the request is HTTP. Option E is wrong because WAF does not inspect SSL certificate details.

Answer

SSL certificate of the client

Answer

Request body of HTTPS requests