SOA-C02 Security and Compliance Practice Test 15 — 15 Questions

Question 1

A company is using AWS Organizations and wants to delegate administration of a specific member account to a user in the management account. Which TWO steps are required?

Accepted Answer

Grant the user in the management account permissions to assume the role in the member account.. To delegate administration of a member account to a user in the management account, you must create an IAM role in the member account with a trust policy that allows the management account (or a specific user/role in it) to assume that role. Then, the user in the management account must be granted permissions (e.g., via an IAM policy) to call sts:AssumeRole on that role. This cross-account access pattern is the standard AWS mechanism for delegating administrative access without sharing long-term credentials.

Answer

Create an IAM user in the member account with the same name as the management account user.

Answer

Enable AWS Single Sign-On (SSO) for the member account.

Answer

Create a service control policy (SCP) that allows the member account to be administered.

Question 2

An organization needs to encrypt data in transit between an Amazon EC2 instance and an Application Load Balancer (ALB). Which THREE actions should be taken?

Accepted Answer

Ensure the EC2 instance has a valid SSL/TLS certificate installed.. Encrypting data in transit between an EC2 instance and an Application Load Balancer requires the EC2 instance to present a valid SSL/TLS certificate. This allows the ALB to establish a secure HTTPS connection with the instance over the backend (target group) port, ensuring that traffic between the ALB and the instance is encrypted using TLS.

Answer

Enable encryption at rest on the EC2 instance's EBS volumes.

Answer

Configure the security group to allow only encrypted traffic.

Question 3

Refer to the exhibit. A SysOps administrator applies this bucket policy to an S3 bucket. What is the effect of this policy?

Accepted Answer

Allows all HTTPS requests and denies HTTP requests.. The bucket policy uses a condition key `aws:SecureTransport` set to `false` in a `Deny` statement, which explicitly denies any request that does not use HTTPS (i.e., HTTP requests). The `Allow` statement grants access to all principals, but the `Deny` statement overrides it for requests lacking secure transport. Therefore, the net effect is that all HTTPS requests are allowed, and all HTTP requests are denied.

Answer

Allows all requests regardless of encryption.

Answer

Denies all requests to the bucket.

Answer

Denies access to the bucket from any IP other than the VPC.

Question 4

A company has a production AWS account with multiple IAM users. The security team wants to implement a policy that prevents users from launching EC2 instances without an IAM role that grants access to an S3 bucket containing sensitive data. The policy should also allow users to launch instances with other roles. A SysOps administrator creates an IAM policy that denies ec2:RunInstances if the instance does not have a specific IAM instance profile. However, users are still able to launch instances without any role. What is the most likely reason, and what should be done to fix it?

Accepted Answer

The condition key is incorrect; the policy should use 'ec2:InstanceProfile' condition key with a specific ARN.. The correct condition key for checking an instance's IAM role at launch is 'ec2:InstanceProfile', not 'ec2:InstanceProfileArn'. The 'ec2:InstanceProfile' condition key evaluates the ARN of the instance profile associated with the instance. Using 'ec2:InstanceProfileArn' is not a valid condition key for EC2, so the policy never matches, and the deny effect never applies, allowing users to launch instances without any role.

Answer

The condition key 'ec2:InstanceProfileArn' is misspelled; it should be 'ec2:IamInstanceProfile'.

Answer

The policy should be attached to the user's group instead of the user.

Answer

The policy needs to be applied as a service control policy (SCP) to be effective.

Question 5

A SysOps administrator is managing an AWS account that contains multiple S3 buckets. The security team requires that all objects uploaded to any S3 bucket must be encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). The administrator wants to enforce this using a bucket policy that denies uploads without the x-amz-server-side-encryption header set to AES256. After implementing the policy on a test bucket, the administrator finds that some PutObject API calls from an application are failing even though the application is sending the correct header. The application uses the AWS SDK and the bucket is in the same region. What is the most likely cause?

Accepted Answer

The bucket has default encryption enabled, and the SDK is not sending the encryption header because it relies on default encryption.. The most likely cause is that the bucket has default encryption enabled, and the application's SDK is not sending the x-amz-server-side-encryption header because it relies on the bucket's default encryption settings. The bucket policy denies PutObject requests without the header, causing the API calls to fail even though the objects would be encrypted by default. Option A correctly identifies this issue. The other options are incorrect: Option B suggests making the policy less restrictive, but the security requirement is to enforce SSE-S3 for all uploads. Option C is unrelated because ACLs do not affect encryption headers. Option D is irrelevant because SSE-S3 uses S3-managed keys, not KMS.

Answer

The bucket policy is too restrictive; it should allow s3:PutObject without encryption for certain principals.

Answer

The bucket has an ACL that denies PutObject for the application's IAM role.

Answer

The application is using an IAM role that does not have permission to use the KMS key for encryption.

Question 6

A company has an AWS account with several IAM users. The SysOps administrator needs to ensure that all users are required to use multi-factor authentication (MFA) to access the AWS Management Console. The administrator has enabled MFA for each user and created an IAM policy that denies all actions unless MFA is present. However, some users report that they can still access the console without MFA. What is the most likely reason?

Accepted Answer

The condition key in the policy is incorrect; it should be 'aws:MultiFactorAuthPresent' set to 'true'.. The IAM policy condition key 'aws:MultiFactorAuthPresent' must be explicitly set to 'true' to require MFA. If the condition key is misspelled or uses a different value (e.g., 'BoolIfExists' without the proper key), the policy will not enforce MFA, allowing users to access the console without it. The administrator likely used an incorrect condition key or omitted the 'aws:MultiFactorAuthPresent' key entirely.

Answer

The users are using the root account credentials.

Answer

The policy is attached to a group instead of the users.

Answer

The password policy does not require MFA.

Question 7

A company has a requirement to store audit logs for a minimum of 7 years to comply with regulatory standards. The logs are currently stored in Amazon S3. The SysOps administrator needs to ensure that logs are not deleted before the retention period expires. Which solution should be implemented?

Accepted Answer

Enable S3 Object Lock with a retention mode of GOVERNANCE or COMPLIANCE and set a retention period of 7 years.. S3 Object Lock with a retention mode (GOVERNANCE or COMPLIANCE) prevents objects from being deleted or overwritten until the retention period expires. This ensures logs are retained for 7 years. Option A is incorrect because MFA Delete provides an extra layer of security but can still be bypassed by the root user and does not enforce a minimum retention period; it only requires MFA for deletion, but deletion is still possible. Option B is incorrect because versioning alone does not prevent deletion; it allows recovering deleted objects but does not enforce retention. Lifecycle policies can transition objects to S3 Glacier but do not prevent deletion. Option C is incorrect because a bucket policy denying s3:DeleteObject for all principals would also prevent the bucket owner from deleting objects, which is not practical and can be overridden by an explicit allow. Moreover, such a policy does not enforce a retention period; it can be changed at any time. S3 Object Lock is the appropriate solution to meet the 7-year retention requirement.

Answer

Enable MFA Delete on the bucket to require multi-factor authentication for deletions.

Answer

Enable versioning on the bucket and use lifecycle policies to transition objects to S3 Glacier.

Answer

Create an S3 bucket policy that denies s3:DeleteObject for all principals.

Question 8

A company hosts a critical web application on EC2 instances behind an Application Load Balancer. The security team enabled AWS WAF on the ALB to block SQL injection and XSS attacks. They also use AWS Shield Advanced for DDoS protection. Recently, the application experienced intermittent performance degradation during normal traffic patterns. The security team reviewed the WAF logs and found that legitimate user requests with query strings containing the word "select" (e.g., ?category=select+option) were being blocked. The team wants to ensure that only actual SQL injection attempts are blocked, not legitimate requests with similar patterns. What course of action should the SysOps administrator take to resolve this issue while maintaining security?

Accepted Answer

Create a custom WAF rule that inspects specific query string parameters with a more precise regex pattern to reduce false positives.. AWS WAF allows you to create custom rules with conditions that can be scoped to specific parts of the request (e.g., URI path, query string). By creating a custom rule that targets the specific parameter (e.g., 'category') and uses a more precise regex pattern (like looking for SQL keywords in specific contexts), you can reduce false positives while still blocking actual SQL injection attempts. Option A is wrong because disabling the SQL injection rule entirely removes protection. Option B is wrong because switching to rate-based rules does not address SQL injection false positives. Option D is wrong because Shield Advanced does not have the ability to fine-tune WAF rules; it focuses on DDoS protection.

Answer

Disable the SQL injection rule in AWS WAF and rely solely on AWS Shield Advanced for protection.

Answer

Enable AWS Shield Advanced's automatic mitigation feature to handle all layer 7 attacks.

Answer

Replace the WAF SQL injection rule with a rate-based rule to limit request rates from specific IPs.

Question 9

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

Accepted Answer

AWS Config with a custom rule and AWS Lambda. AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Answer

AWS CloudTrail and Amazon CloudWatch Events

Answer

AWS Service Catalog and AWS Organizations

Answer

Amazon Inspector and AWS Systems Manager

Question 10

A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning. AWS Config with the managed rule `s3-bucket-versioning-enabled` continuously evaluates S3 buckets against the desired configuration. When a noncompliant bucket is detected, an automatic remediation action can be configured to invoke an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven remediation without manual intervention, ensuring all buckets—including those created outside of AWS Config's initial evaluation—are brought into compliance.

Answer

Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning

Answer

Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action

Answer

Use AWS Service Catalog to enforce versioning on all buckets provisioned through it

Question 11

A company's security policy requires that all Amazon RDS for PostgreSQL instances be encrypted at rest using AWS Key Management Service (KMS) customer managed keys and have automated backups enabled with a retention period of at least 30 days. A SysOps administrator needs to use AWS Config to automatically detect any RDS instance that is non-compliant with either requirement and automatically remediate it. Which combination of AWS Config managed rules and remediation actions should be used?

Accepted Answer

Use the AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure automatic remediation for each rule using the corresponding AWS Systems Manager Automation runbook: 'AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup'.. AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled' natively evaluate encryption and backup compliance. The corresponding AWS Systems Manager Automation runbooks ('AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup') provide built-in, automatic remediation without custom code, aligning with the requirement to use managed rules and automatic remediation.

Answer

Use two AWS Config managed rules: 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure each rule with an automatic remediation action that triggers an Amazon CloudWatch alarm, which then invokes an AWS Lambda function to enable encryption and backups.

Answer

Create custom AWS Config rules as AWS Lambda functions that evaluate the RDS instance configuration. In the Lambda function, if a resource is non-compliant, call the RDS API to enable encryption and modify backup settings.

Answer

Use a single custom AWS Config rule that checks both encryption and backup settings. If non-compliant, trigger an AWS Lambda function that uses the RDS API to configure both settings.

Question 12

A company's security policy requires that all Amazon S3 buckets must have server-side encryption with AWS Key Management Service (SSE-KMS) enabled. The SysOps administrator needs to automatically detect any existing or new S3 bucket that does not have SSE-KMS enabled and automatically apply the encryption configuration. The solution must use managed AWS services with minimal custom code. Which combination of AWS services should be used?

Accepted Answer

Use AWS Config with a custom rule backed by an AWS Lambda function that checks if the S3 bucket has default SSE-KMS encryption enabled, and auto-remediates by enabling SSE-KMS default encryption (e.g., calling the PutBucketEncryption API).. It uses AWS Config with a custom Lambda-backed rule to detect non-compliant S3 buckets (those missing SSE-KMS) and auto-remediate by calling the PutBucketEncryption API to enable default SSE-KMS encryption on the bucket. This satisfies the requirement for minimal custom code (only the Lambda function) and uses managed AWS services (AWS Config, Lambda, S3) to automatically detect and fix both existing and new buckets, ensuring that all S3 buckets have SSE-KMS enabled as per the security policy.

Answer

Enable default encryption on the AWS account's S3 buckets using an S3 account-level setting in the S3 console, which automatically applies SSE-KMS to all new buckets.

Answer

Create an AWS CloudTrail event that triggers an AWS Lambda function when a bucket is created, and the Lambda applies SSE-KMS encryption. Use AWS Config to periodically scan existing buckets and apply encryption.

Answer

Use AWS Identity and Access Management (IAM) with a Service Control Policy (SCP) that denies any S3 bucket creation without SSE-KMS enabled, and use AWS Config to detect and notify on non-compliance.

Question 13

An organization wants to ensure that no Amazon S3 bucket in the entire AWS Organization can be made public. The security team requires a preventive control that cannot be overridden by individual account administrators. Which AWS service or feature should be used?

Accepted Answer

Create a Service Control Policy (SCP) in AWS Organizations that denies permissions to modify S3 bucket public access settings.. A Service Control Policy (SCP) in AWS Organizations is a preventive guard that applies to all accounts within the organization. It can explicitly deny actions like s3:PutBucketPublicAccessBlock, s3:PutBucketPolicy, and s3:PutObjectAcl, preventing any principal (including root users) from making S3 buckets public. Unlike detective or account-level controls, SCPs cannot be overridden by individual account administrators, meeting the requirement for a non-overridable preventive control.

Answer

Enable AWS Config rules in each account to detect public S3 buckets and automatically remediate them using AWS Lambda.

Answer

Use an IAM policy attached to all IAM users in each account that denies s3:PutBucketPolicy.

Answer

Apply Amazon S3 Block Public Access at the account level in each individual AWS account.

Question 14

A company uses AWS Organizations and wants to restrict access to S3 buckets based on project tags. The security policy requires that users in the 'DataScientists' group can only access S3 buckets that have the tag 'Project: DataEngineering'. Which IAM policy condition key should the SysOps administrator use in a customer managed policy to enforce this restriction?

Accepted Answer

aws:ResourceTag. The `aws:ResourceTag` condition key is used in IAM policies to control access based on the tags attached to the AWS resource (in this case, an S3 bucket). By specifying `aws:ResourceTag/Project` with a value of `DataEngineering`, the policy ensures that only S3 buckets with that exact tag are accessible to the 'DataScientists' group. This key is evaluated against the resource's tags at the time of the request, making it the appropriate choice for tag-based resource restrictions.

Answer

s3:ExistingObjectTag

Answer

s3:ResourceTag

Answer

iam:ResourceTag

Question 15

A company's security policy requires that all Amazon S3 buckets must be encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). A SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and automatically apply SSE-S3 encryption. The solution should leverage AWS managed services and minimize custom code. Which combination of AWS services should be used?

Accepted Answer

AWS Config and AWS Lambda. AWS Config can evaluate S3 bucket configurations against a managed rule (s3-bucket-server-side-encryption-enabled) to detect non-compliant buckets. When a non-compliant bucket is detected, AWS Config can trigger an AWS Lambda function via an Amazon EventBridge rule or a custom remediation action to automatically enable SSE-S3 encryption on the bucket. This combination uses managed services and minimizes custom code, meeting the security policy requirement.

Answer

Amazon GuardDuty and AWS Lambda

Answer

AWS CloudTrail and Amazon EventBridge

Answer

Amazon Macie and AWS Step Functions