SOA-C02 Security and Compliance Practice Test 16 — 15 Questions

Question 1

A company requires that all users in an AWS account must authenticate with multi-factor authentication (MFA) before they can perform any actions on Amazon EC2 instances. The SysOps administrator needs to implement this requirement using IAM policies. Which IAM policy condition key should be used to enforce MFA?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key checks whether the user authenticated using a valid MFA device before making the API request. By setting this condition to `true` in an IAM policy, you can enforce that all actions on EC2 instances require MFA authentication, meeting the company's requirement.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

iam:PassedToService

Question 2

A company requires that all Amazon S3 buckets in its AWS account must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to detect any bucket that does not have KMS encryption enabled and automatically remediate it by enabling encryption. Which AWS service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously monitor S3 bucket configurations against a desired encryption state using managed rules like 's3-bucket-server-side-encryption-enabled' or custom Lambda rules. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-KMS encryption, enforcing compliance without manual intervention.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 3

A company operates a web application behind an Application Load Balancer (ALB). The SysOps administrator needs to block incoming requests from specific geographic locations (countries X and Y) and also enforce a rate limit of 100 requests per IP address per 5-minute window to mitigate DDoS attacks. The solution must be centrally configured and apply to all requests handled by the ALB. Which AWS service should be used to implement these requirements?

Accepted Answer

AWS WAF. AWS WAF is the correct service because it provides both geographic (geo-match) blocking and rate-based rules that can be associated directly with an Application Load Balancer. Geo-match conditions allow you to block requests from specific countries (X and Y), while rate-based rules can limit requests to 100 per 5-minute window per source IP. This solution is centrally configured at the ALB level, applying to all incoming requests without requiring additional infrastructure.

Answer

Amazon CloudFront geo restriction

Answer

AWS Shield Advanced

Answer

Security Groups

Question 4

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

Accepted Answer

AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.. AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Answer

AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications.

Answer

Amazon Macie to discover sensitive data and then manually encrypt buckets.

Question 5

A company's security policy requires that all IAM user passwords must be at least 12 characters long. The SysOps administrator needs to enforce this requirement across the AWS account. Which action should the administrator take?

Accepted Answer

Update the IAM account password policy to require a minimum length of 12 characters.. The IAM account password policy is the native AWS mechanism for enforcing password requirements across all IAM users in an account. By updating this policy to require a minimum length of 12 characters, the administrator ensures that any new or changed password must comply, and existing passwords are not affected until the next change. This is a direct, account-wide setting that requires no additional services or custom logic.

Answer

Create an AWS Config rule to check password length and auto-remediate.

Answer

Enable AWS CloudTrail to monitor for password changes and alert the administrator.

Answer

Attach a service control policy (SCP) that denies IAM user creation if the password is less than 12 characters.

Question 6

A company uses AWS Organizations to manage multiple AWS accounts. The security team wants to restrict access to a specific AWS service (Amazon EC2) in all accounts except for the 'production' account. The SysOps administrator needs to implement this restriction centrally. Which approach should the administrator use?

Accepted Answer

Attach a service control policy (SCP) to the organization root or to the OUs of non-production accounts that denies access to Amazon EC2.. Service control policies (SCPs) are the correct mechanism for centrally restricting permissions across accounts in AWS Organizations. By attaching an SCP that denies EC2 actions to the organization root or to the OUs containing non-production accounts, the security team can enforce this restriction at the account level, overriding any IAM policies within those accounts. This approach ensures that even if a user or role in a non-production account has an IAM policy granting EC2 access, the SCP will block it.

Answer

Create an IAM policy that denies Amazon EC2 actions and attach it to all users and roles in non-production accounts.

Answer

Use AWS Config to create a rule that detects EC2 usage in non-production accounts and automatically terminates instances.

Answer

Create a resource-based policy on each EC2 instance that denies access from non-production accounts.

Question 7

Developers are allowed to create IAM roles for their Lambda functions. However, the security team is concerned that developers could create roles with Administrator access, granting Lambda functions more permissions than the developers themselves have. What IAM feature prevents privilege escalation in this scenario?

Accepted Answer

Attach a permission boundary to each developer IAM user that limits them to creating roles with only the permissions they are allowed to grant. Permission boundaries are an IAM feature that allow you to set the maximum permissions that an identity-based policy can grant to a principal. By attaching a permission boundary to each developer IAM user that restricts them to creating roles with only the permissions they are allowed to grant, you prevent the developer from creating a Lambda execution role with AdministratorAccess or any other policy that exceeds the boundary. This directly addresses the privilege escalation concern because the boundary acts as a ceiling on the permissions the developer can delegate to the role.

Answer

Enable IAM Access Analyzer to detect when developers create overly permissive roles

Answer

Require MFA for all IAM API calls so developers must re-authenticate before creating roles

Answer

Enable CloudTrail logging for all IAM API calls and set up a CloudWatch alarm for iam:CreateRole events

Question 8

The CISO asks for a centralized dashboard showing security findings from GuardDuty, Macie, Inspector, and Firewall Manager across 30 AWS accounts. Findings must be normalized into a single format so they can be prioritized by severity without switching between services. Which AWS service provides this capability?

Accepted Answer

Enable AWS Security Hub with an administrator account in the organization; integrate GuardDuty, Macie, Inspector, and Firewall Manager as finding providers. AWS Security Hub is designed to aggregate, normalize, and prioritize security findings from multiple AWS services (GuardDuty, Macie, Inspector, Firewall Manager) and third-party tools across accounts. By designating an administrator account in AWS Organizations, you can centrally view all findings in a single dashboard, with a standardized findings format (AWS Security Finding Format, ASFF) that includes severity, resource, and remediation fields. This directly meets the CISO's requirement for a centralized, normalized, severity-prioritized view without switching between services.

Answer

Deploy a custom Lambda function that polls each service's API and writes findings to a DynamoDB table for a custom dashboard

Answer

Enable Amazon Detective to investigate and correlate security findings across all accounts

Answer

Configure AWS Config conformance packs to evaluate security compliance checks across all accounts and report to an aggregator account

Question 9

Account A owns an S3 bucket containing shared artifacts. Account B needs to read objects from the bucket. The Account A team wants to grant access without creating IAM users, sharing access keys, or creating a role in Account A that Account B assumes. How should the bucket be configured to allow Account B's IAM roles to read objects?

Accepted Answer

Add an S3 bucket policy on Account A's bucket with Principal set to Account B's account ID and s3:GetObject permission; ensure Account B's roles have s3:GetObject in their identity policies. It uses an S3 bucket policy with a Principal set to Account B's account ID, which grants cross-account access to all IAM principals (users and roles) in Account B. Account B's IAM roles must also have an identity policy that allows s3:GetObject, ensuring that the effective permissions require both the bucket policy and the role's policy to allow the action. This approach avoids creating IAM users, sharing access keys, or setting up a role in Account A for Account B to assume.

Answer

Create an IAM role in Account A with s3:GetObject permission and a trust policy allowing Account B's roles to assume it

Answer

Generate a presigned URL for each object in Account A and share the URLs with Account B's services

Answer

Enable S3 Access Points on the bucket and create an access point that allows Account B's VPC to connect via PrivateLink

Question 10

An application stores its RDS PostgreSQL credentials in AWS Secrets Manager. The security policy requires credentials to be rotated every 30 days automatically. During rotation, the application must continue to serve traffic with zero downtime. The application retrieves credentials by calling GetSecretValue at the start of each database connection. What must be configured to satisfy all requirements?

Accepted Answer

Enable automatic rotation in Secrets Manager with a 30-day schedule; use the AWS-provided Lambda rotation function for RDS PostgreSQL; ensure the application calls GetSecretValue per connection rather than caching credentials. AWS Secrets Manager's automatic rotation, combined with the AWS-provided Lambda rotation function for RDS PostgreSQL, ensures credentials are rotated every 30 days without manual intervention. The application's practice of calling GetSecretValue at the start of each database connection guarantees it always retrieves the current secret, avoiding stale credentials and achieving zero downtime during rotation.

Answer

Rotate credentials manually every 30 days by updating the secret value in the console and restarting the application

Answer

Create an EventBridge scheduled rule every 30 days that triggers a Lambda to generate a new RDS password and update both the database and the secret

Answer

Store credentials in an environment variable on the application's EC2 instance and rotate by updating the environment variable and reloading the application

Question 11

Drag and drop the steps to create an Amazon CloudWatch alarm that sends an email notification when CPU utilization exceeds 90% into the correct order.

Accepted Answer

Set up an SNS topic, then create the alarm selecting the CPU utilization metric, then define the condition (CPU > 90%), then add the notification action with the SNS topic.. First set up the SNS topic, then create the alarm selecting the metric, define the condition, and finally add the notification action.

Answer

Create the alarm selecting the CPU utilization metric, then set up an SNS topic, then define the condition (CPU > 90%), then add the notification action with the SNS topic.

Answer

Set up an SNS topic, then add the notification action with the SNS topic, then create the alarm selecting the CPU utilization metric, then define the condition (CPU > 90%).

Answer

Create the alarm selecting the CPU utilization metric, then define the condition (CPU > 90%), then set up an SNS topic, then add the notification action with the SNS topic.

Question 12

Drag and drop the steps to configure an Amazon Route 53 failover routing policy into the correct order.

Accepted Answer

Create health checks, then create primary failover record, then create secondary failover record, then test failover.. Create health checks first, then create primary and secondary records with failover types, then test.

Answer

Create primary failover record, then create health checks, then create secondary failover record, then test failover.

Answer

Create health checks, then create secondary failover record, then create primary failover record, then test failover.

Answer

Create health checks, then create primary failover record, then test failover, then create secondary failover record.

Question 13

A company uses AWS Key Management Service (KMS) to encrypt data in Amazon S3. They want to ensure that the KMS key can only be used from within a specific VPC. How can this be accomplished?

Accepted Answer

Add a condition in the KMS key policy using 'aws:SourceVpc' to restrict usage to the VPC.. A KMS key policy can use the 'aws:SourceVpc' condition key to restrict usage of the key to requests originating from a specific VPC. Option A is incorrect because S3 bucket policies cannot directly restrict KMS key usage; they can only control access to S3 objects. Option C is incorrect because IAM policies can include conditions based on source VPC for certain services, but for KMS actions, the condition must be in the key policy itself, not an IAM policy. Option D is incorrect because network ACLs operate at the subnet level and control network traffic, not API calls to KMS; they cannot restrict access to the KMS service.

Answer

Add a condition in the S3 bucket policy to allow only requests from the VPC.

Answer

Use an IAM policy with a condition that requires the request to come from the VPC.

Answer

Configure a network ACL that blocks all traffic to KMS except from the VPC.

Question 14

A SysOps administrator needs to audit all changes to IAM resources in their AWS account. Which THREE AWS services can be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all IAM API calls, providing a detailed audit trail of changes. Option C is correct because AWS Config tracks changes to IAM resource configurations and can evaluate them against rules. Option E is correct because Amazon CloudWatch Logs can store and monitor CloudTrail logs, enabling alerting on specific IAM changes. Option B is wrong because Amazon GuardDuty is for threat detection, not auditing configuration changes. Option D is wrong because AWS Trusted Advisor provides best-practice checks but does not log or track changes to IAM resources.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 15

A company wants to ensure that their Amazon S3 bucket policy only allows access from a specific VPC endpoint. Which TWO condition keys can be used in the bucket policy? (Choose TWO.)

Accepted Answer

aws:SourceVpc. The correct condition keys are 'aws:SourceVpc' (option C) and 'aws:SourceVpce' (option E). 'aws:SourceVpc' restricts access to all VPC endpoints within a specified VPC, while 'aws:SourceVpce' restricts access to a specific VPC endpoint. Option A 's3:SourceVpce' is not a valid condition key. Option B 'aws:SourceIp' is used for IP address restrictions, not VPC endpoints. Option D 'ec2:Vpc' is not applicable in S3 bucket policies.

Answer

s3:SourceVpce

Answer

aws:SourceIp

Answer

ec2:Vpc