SOA-C02 Security and Compliance Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. A SysOps administrator creates this stack. Which of the following is true about the bucket?

Accepted Answer

The bucket has versioning enabled. The exhibit shows a CloudFormation template where the S3 bucket resource includes the VersioningConfiguration property with Status set to Enabled. When this stack is deployed, AWS applies that configuration to the bucket, so versioning is active. This means every object overwrite or delete creates a new version rather than destroying the prior object.

Answer

The bucket is publicly accessible

Answer

The bucket does not have versioning enabled

Answer

The bucket allows public read access

Question 2

A company's security team notices that an IAM user has access keys that have not been rotated in over a year. Which action should the SysOps administrator take to enforce key rotation automatically?

Accepted Answer

Set up an AWS Config rule to detect old keys and trigger an AWS Lambda function to rotate them.. AWS Config can evaluate IAM user access keys against a custom or managed rule (e.g., 'access-keys-rotated') to detect keys older than a specified threshold. When a non-compliant key is found, you can configure an AWS Config rule to invoke an AWS Lambda function that programmatically deactivates the old key and creates a new one, enforcing automatic rotation. This is the only native, automated approach that combines detection and remediation without manual intervention.

Answer

Apply a service control policy (SCP) that requires key rotation.

Answer

Configure an IAM policy that automatically rotates keys every 90 days.

Answer

Use AWS Trusted Advisor to automatically rotate the keys.

Question 3

An organization wants to centrally manage access to multiple AWS accounts in an AWS Organizations setup. Which AWS service should the SysOps administrator use to define and enforce fine-grained permissions across accounts?

Accepted Answer

IAM roles with cross-account trust policies. IAM roles with cross-account trust policies allow a SysOps administrator to define fine-grained permissions centrally in a single AWS account (the management or security account) and then grant access to users or services in other accounts by assuming the role. This approach uses AWS Security Token Service (STS) to issue temporary credentials, enabling precise control over actions and resources across accounts without duplicating IAM users or policies.

Answer

AWS Config rules

Answer

Service control policies (SCPs)

Answer

AWS Single Sign-On (SSO)

Question 4

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. Which combination of services should the SysOps administrator use to meet this requirement?

Accepted Answer

A CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification. Amazon CloudWatch Events (now Amazon EventBridge) can match AWS API calls recorded by CloudTrail, such as CreateAccessKey, and route them to targets like SNS for alerting. The rule pattern matches the event source (iam.amazonaws.com) and event name (CreateAccessKey), then triggers an SNS notification to the security team. This is the standard serverless approach for real-time alerting on specific API activity.

Answer

CloudWatch Logs Insights query on CloudTrail logs with an alarm

Answer

An AWS Config rule that checks for new access keys and sends an SNS notification

Answer

S3 event notifications to an SNS topic

Question 5

Which TWO actions can a SysOps administrator take to secure an Amazon S3 bucket that contains sensitive data? (Choose TWO.)

Accepted Answer

Enable default encryption using AWS KMS (SSE-KMS) on the bucket.. Enabling default encryption with SSE-KMS ensures that all objects uploaded to the S3 bucket are automatically encrypted at rest using AWS KMS-managed keys. This protects sensitive data even if the uploader forgets to specify encryption, meeting security and compliance requirements for data-at-rest protection.

Answer

Configure a cross-origin resource sharing (CORS) policy.

Answer

Enable cross-region replication for the bucket.

Answer

Enable MFA Delete on the bucket to require multi-factor authentication for delete operations.

Question 6

A company needs to comply with PCI DSS requirements for its AWS environment. Which TWO services should the SysOps administrator use to automate compliance checks and generate reports? (Choose TWO.)

Accepted Answer

AWS Config. AWS Config (B) is correct because it continuously records resource configuration changes and evaluates them against managed or custom rules, such as the PCI DSS conformance pack, which automates compliance checks against AWS resources. AWS Audit Manager (E) is correct because it automates evidence collection and produces audit-ready reports mapped to frameworks like PCI DSS, which is exactly what the company needs for generating compliance reports. Amazon CloudWatch (A) is for metrics, logs, and alarms, not compliance evaluation or audit reporting. AWS CloudTrail (C) records API activity for auditing but does not itself perform automated compliance checks or generate compliance reports. AWS Trusted Advisor (D) provides best-practice recommendations across cost, security, and limits, but it is not a PCI DSS compliance automation or reporting service.

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 7

A company has an AWS account with multiple VPCs connected via a transit gateway. The SysOps administrator needs to ensure that all traffic between VPCs is encrypted in transit. Which solution should the administrator implement?

Accepted Answer

Set up AWS Site-to-Site VPN connections between the VPCs via the transit gateway.. AWS Site-to-Site VPN connections between VPCs via a transit gateway can enforce IPsec encryption for all inter-VPC traffic. The transit gateway acts as a central hub, and each VPN connection encrypts traffic using IPsec tunnels, ensuring data confidentiality and integrity in transit. This meets the requirement for encrypted transit between VPCs without relying on third-party appliances.

Answer

Use VPC peering connections between the VPCs.

Answer

Use VPC endpoints to route traffic through AWS PrivateLink.

Answer

Configure network ACLs to deny unencrypted traffic.

Question 8

A SysOps administrator needs to provide temporary, limited-privilege credentials to an application running on an EC2 instance. The application needs to access an S3 bucket. What is the most secure way to grant these credentials?

Accepted Answer

Attach an IAM role with the necessary permissions to the EC2 instance.. Attaching an IAM role to an EC2 instance is the most secure method because it leverages the AWS Security Token Service (STS) to automatically rotate temporary credentials. The instance retrieves these credentials via the instance metadata service (IMDS), eliminating the need to hardcode, store, or manually manage long-term access keys. This approach follows the principle of least privilege and ensures credentials are automatically rotated and revoked when the role is detached.

Answer

Use a Lambda function to generate temporary credentials from an IAM user.

Answer

Store the AWS access keys in an S3 bucket and have the application download them at startup.

Answer

Create an IAM user with programmatic access and store the access keys in the application's environment variables.

Question 9

A SysOps administrator is designing a VPC for a web application that must be secure. Which THREE security measures should the administrator implement? (Choose THREE.)

Accepted Answer

Configure network ACLs to filter traffic at the subnet level.. Network ACLs (NACLs) are stateless firewalls that operate at the subnet level, providing an additional layer of security by filtering traffic entering and exiting each subnet. By default, NACLs allow all traffic, but you can configure custom rules to explicitly allow or deny traffic based on IP addresses, protocols, and port ranges, which is essential for securing a web application VPC.

Answer

Place all resources in public subnets to simplify access.

Answer

Use the default VPC for simplicity.

Question 10

A company requires that all access to the AWS Management Console be protected by multi-factor authentication (MFA). The SysOps administrator has enabled an IAM policy that denies all actions if the user does not authenticate with MFA. However, some users report they cannot list their own MFA devices. What is the MOST likely cause?

Accepted Answer

The policy denies the iam:ListMFADevices action without an MFA-authenticated session. The IAM policy that denies all actions unless the user is authenticated with MFA will also block the iam:ListMFADevices action because that API call is made without an MFA-authenticated session. When a user tries to list their own MFA devices, they have not yet passed the MFA challenge, so the session is not MFA-authenticated, and the deny policy applies. This creates a catch-22: the user cannot list their devices to manage MFA because listing requires MFA, but they need to list devices to set up MFA.

Answer

The policy is applied to the root user only

Answer

Users are not using MFA-enabled access keys

Answer

The policy is not applied in the us-east-1 region

Question 11

A company uses AWS CloudTrail to log all API calls. The security team requires that all logs be encrypted at rest and stored in an S3 bucket that blocks public access. The SysOps administrator configures the bucket with default encryption (SSE-S3) and a bucket policy that denies all actions unless the request includes the x-amz-server-side-encryption header with value AES256. However, CloudTrail delivery fails. What is the MOST likely cause?

Accepted Answer

The bucket policy requires the x-amz-server-side-encryption header, but CloudTrail does not include this header. CloudTrail does not include the x-amz-server-side-encryption header when delivering log files to S3. The bucket policy requires this header for all PutObject requests, so CloudTrail's PUT requests are denied, causing delivery to fail. SSE-S3 encryption is applied automatically by S3 when default encryption is enabled, but the policy condition overrides that by requiring the header explicitly.

Answer

CloudTrail does not support SSE-S3 encryption

Answer

The bucket policy does not grant CloudTrail the s3:PutObject permission

Answer

The bucket has default encryption enabled, which conflicts with CloudTrail's encryption

Question 12

A company uses AWS Key Management Service (KMS) to encrypt data in S3. The security team wants to ensure that only a specific IAM role can decrypt objects in a particular S3 bucket. Which of the following is the MOST effective way to achieve this?

Accepted Answer

Use a KMS key policy with a condition that requires the encryption context to match the bucket ARN, and grant the IAM role decrypt permissions. It uses a KMS key policy with a condition that restricts decryption to requests where the encryption context matches the S3 bucket ARN. This ensures that only the specified IAM role, when making decrypt calls with the correct encryption context, can decrypt objects in that bucket. It directly ties the KMS key's decrypt permission to the bucket, providing a granular and secure access control mechanism.

Answer

Create a separate KMS key for each bucket and assign the IAM role as a key user

Answer

Configure an S3 bucket policy that allows only the IAM role to perform s3:GetObject

Answer

Use an S3 bucket policy that denies s3:GetObject unless the request includes the x-amz-server-side-encryption-aws-kms-key-id header

Question 13

A company uses AWS Config to track resource changes. The security team wants to receive notifications whenever an IAM policy is changed. Which AWS service should be used with AWS Config to send notifications?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is the correct service to pair with AWS Config to send notifications when an IAM policy changes. AWS Config can publish configuration change events to an SNS topic, which then delivers notifications via email, SMS, or other protocols to the security team. This integration allows real-time alerting on resource changes without additional polling or custom logic.

Answer

Amazon CloudWatch Logs

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS CloudTrail

Question 14

A company has an S3 bucket that stores sensitive data. The security team requires that all access to the bucket be encrypted in transit. Which TWO actions should be taken to enforce this requirement? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm for any HTTP access. Enabling AWS CloudTrail to log all S3 API calls and setting up a CloudWatch alarm for any HTTP access allows the security team to detect and alert on any access that is not encrypted in transit (i.e., HTTP instead of HTTPS). This provides monitoring and incident response capability to enforce the encryption-in-transit requirement.

Answer

Enable default encryption (SSE-S3) on the bucket

Answer

Enable S3 Transfer Acceleration

Answer

Use S3 VPC endpoints

Question 15

A company wants to audit all AWS account activity for compliance. Which THREE AWS services should be used together to achieve this? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (E) is the foundational service for auditing AWS account activity because it records API calls and management events across the account, delivering the raw audit trail needed for compliance. Amazon CloudWatch Logs (A) is correct because CloudTrail can deliver its event logs to a CloudWatch Logs log group, where they can be retained, searched with metric filters, and alerted on for compliance monitoring. AWS Config (B) is correct because it continuously records resource configuration changes and evaluates them against compliance rules, complementing CloudTrail's activity records with configuration history and drift detection. AWS Trusted Advisor (C) is not part of an activity-auditing pipeline; it only provides best-practice checks and recommendations. Amazon GuardDuty (D) is a threat-detection service that analyzes logs for malicious behavior, not a primary audit or compliance-recording service.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty