SOA-C02 Security and Compliance Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. An IAM user has this policy attached. The user tries to start an EC2 instance that has no tags. What will happen?

Accepted Answer

The user will be denied because the instance does not have the required tag. The IAM policy includes a condition that requires the EC2 instance to have a tag with key 'Environment' and value 'Production'. When the instance has no tags, the condition evaluates to false, and the default behavior for IAM policies is to deny access when a condition is not met. Since the policy does not explicitly allow the action without the tag, the request is implicitly denied.

Answer

The user will be allowed because the condition only applies if the tag exists

Answer

The user will be allowed because the resource ARN includes a wildcard

Answer

The user will be allowed because the policy does not explicitly deny the action

Question 2

Refer to the exhibit. The security team wants to ensure that all objects uploaded to the S3 bucket 'my-secure-bucket' are encrypted at rest. Based on the CloudTrail log entry, what can be concluded about the object 'confidential.pdf'?

Accepted Answer

The object is encrypted with SSE-S3. The CloudTrail log entry shows that the object 'confidential.pdf' was uploaded with the 'x-amz-server-side-encryption' header set to 'AES256'. This header indicates that server-side encryption with Amazon S3-managed keys (SSE-S3) was requested. The response also confirms that encryption was applied. Therefore, the object is encrypted with SSE-S3, making option C correct. Option A is incorrect because the log does not mention KMS key details. Option B is incorrect because the object is encrypted. Option D is incorrect because the encryption header was provided.

Answer

The object is encrypted with AWS KMS

Answer

The object is not encrypted

Answer

The object was uploaded without an encryption header

Question 3

Refer to the exhibit. An IAM role has the trust policy shown. Which entity can assume this role?

Accepted Answer

Any IAM user in the AWS account 123456789012. The trust policy specifies `"AWS": "arn:aws:iam::123456789012:root"` as the principal, which allows any IAM user or role within the AWS account 123456789012 to assume the role, provided they have the necessary permissions in their own identity-based policies. This is because the root ARN of an account acts as a wildcard for all identities in that account. Option C correctly identifies that any IAM user in that account can assume the role.

Answer

Only the IAM user with the ARN arn:aws:iam::123456789012:user/Admin

Answer

Any IAM user in any AWS account

Answer

Only users who have MFA enabled

Question 4

A company wants to enforce that all IAM users in an AWS account must use multi-factor authentication (MFA) to access the AWS Management Console. Which IAM policy effect should be used to deny access if MFA is not present?

Accepted Answer

Deny with a condition that aws:MultiFactorAuthPresent is false. The IAM policy must explicitly deny access when MFA is not present. By using a Deny effect with the condition aws:MultiFactorAuthPresent set to false, any request that does not include MFA authentication is blocked. This is the standard approach to enforce MFA usage, as IAM policies default to an implicit deny, but an explicit Deny overrides any Allow that might otherwise grant access.

Answer

Allow with a condition that aws:MultiFactorAuthPresent is false

Answer

Allow with a condition that aws:MultiFactorAuthPresent is true

Answer

Deny with a condition that aws:MultiFactorAuthPresent is true

Question 5

A company uses AWS CloudTrail to log API calls. The SysOps team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and triggers an automated response. Which combination of services should be used? (Choose two.)

Accepted Answer

AWS Lambda. Amazon EventBridge (CloudWatch Events) can monitor CloudTrail API calls in real time and trigger an AWS Lambda function when a `StopLogging` or `UpdateTrail` API call is detected. Lambda then executes the automated response, such as re-enabling logging or sending an alert. This combination provides event-driven detection and remediation without manual intervention.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon Simple Queue Service (SQS)

Question 6

A company has an S3 bucket that contains sensitive customer data. The security team requires that all data in transit to and from the bucket must be encrypted. Which bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The aws:SecureTransport condition key in an S3 bucket policy checks whether the request was sent using SSL/TLS. Setting it to 'true' denies any requests that are not encrypted in transit, enforcing HTTPS for all access to the bucket. This directly meets the requirement that all data in transit must be encrypted.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-server-side-encryption

Answer

aws:TLSSupport

Question 7

A SysOps administrator needs to grant an IAM user the ability to rotate their own access keys. What is the minimum set of permissions required?

Accepted Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey. The minimum permissions to allow an IAM user to rotate their own access keys are: iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, and iam:UpdateAccessKey. Option D is correct. Option A is wrong because it includes iam:PutUserPolicy, which is unnecessary for key rotation and grants additional permissions to modify user policies. Option B is wrong because it includes kms:*, which is unrelated to access key rotation and grants excessive permissions. Option C is wrong because it includes iam:GetUser, which is not required for rotating own keys; the user already knows their username or can be resolved via the policy variable.

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, iam:PutUserPolicy

Answer

iam:ListAccessKeys, iam:CreateAccessKey, iam:DeleteAccessKey, kms:*

Answer

iam:GetUser, iam:CreateAccessKey, iam:DeleteAccessKey, iam:UpdateAccessKey

Question 8

A company uses AWS Shield Advanced to protect against DDoS attacks. Which of the following are benefits of AWS Shield Advanced? (Choose TWO.)

Accepted Answer

24/7 access to the DDoS Response Team (DRT). AWS Shield Advanced provides enhanced DDoS protection for resources like EC2, ELB, CloudFront, and Route 53 (option E), and includes 24/7 access to the DDoS Response Team (DRT) (option A). Option B is incorrect because Shield Advanced is not free; it has a monthly cost. Option C is incorrect because integration with AWS WAF is not a direct benefit of Shield Advanced; WAF is a separate service that can be used alongside Shield but is not a benefit of Shield Advanced itself. Option D is incorrect because automatic scaling is not a direct benefit of Shield Advanced; it is handled by other AWS services like Auto Scaling.

Answer

Free for all AWS accounts

Answer

Integration with AWS WAF to create custom rules

Answer

Automatic scaling of resources during an attack

Question 9

A SysOps administrator is configuring CloudTrail to log all management events and data events for S3 buckets. Which of the following are true about CloudTrail logging? (Choose THREE.)

Accepted Answer

CloudTrail logs include the identity of the user who made the API call. CloudTrail logs include the identity of the user or role that made the API call, captured as the `userIdentity` element in the log record. This element contains details such as the ARN, access key ID, and whether the call was made by an IAM user, federated user, or assumed role, enabling full auditability of who performed each action.

Answer

Data events for S3 are logged by default for all buckets

Answer

CloudTrail can log events for all AWS services automatically

Question 10

A company wants to use AWS WAF to protect a web application behind an Application Load Balancer. Which of the following can AWS WAF inspect? (Choose all that apply.)

Accepted Answer

HTTP headers. AWS WAF inspects the HTTP request components that reach the Application Load Balancer, and HTTP headers (Option A) are one of the core inspectable request parts used in rules such as header-match statements. Query string parameters (Option B) are also inspectable, allowing rules to match on keys/values in the URL query, which is essential for blocking injection or abuse patterns. The request body of HTTPS requests (Option D) can be inspected because AWS WAF supports body inspection (with size limits and sampling behavior) even though the traffic is TLS-encrypted at the ALB, since WAF evaluates the decrypted HTTP request. The URI path (Option E) is inspectable via URI-path match conditions, enabling rules that target specific endpoints or path patterns. Option C is not correct because AWS WAF does not inspect the client's SSL/TLS certificate; client certificate handling/validation is a function of the load balancer's mutual TLS configuration, not a WAF match condition.

Answer

SSL certificate of the client

Question 11

Refer to the exhibit. An IAM policy is attached to a user. What is the effective permission regarding the s3:DeleteObject action on the example-bucket?

Accepted Answer

Denied because of the explicit Deny statement. The effective permission is Denied because of the explicit Deny statement. In AWS IAM policy evaluation, an explicit Deny always overrides any Allow, regardless of the order in which statements appear or whether the action is otherwise permitted. Since the policy contains an explicit Deny for s3:DeleteObject on example-bucket, the request is denied.

Answer

Denied because the action is not allowed explicitly

Answer

Allowed because the Allow statement is listed first

Answer

Allowed because the Deny statement has a typo

Question 12

Refer to the exhibit. A SysOps administrator runs the commands shown. Which key(s) have automatic key rotation enabled?

Accepted Answer

Only the first key. The first key has automatic key rotation enabled because the `EnableKeyRotation` API call was made specifically for that key (key ID `1234abcd-12ab-34cd-56ef-1234567890ab`). AWS KMS automatic key rotation is a per-key setting that must be explicitly enabled; it is not enabled by default. The second key (key ID `0987dcba-09fe-87dc-65ba-0987654321fe`) was not subjected to any rotation-enabling command, so it retains the default disabled state.

Answer

Only the second key

Answer

Neither key

Answer

Both keys

Question 13

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used to track these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in your AWS account, including all IAM policy changes such as CreatePolicy, PutUserPolicy, AttachRolePolicy, and DeletePolicy. CloudTrail logs these events with details like the user, source IP, and timestamp, providing a complete audit trail for security and compliance. AWS Config, while capable of tracking configuration changes, does not capture the API-level detail required for auditing who made the change and how.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Question 14

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts have encryption enabled. What is the most efficient way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies S3 actions without encryption.. A service control policy (SCP) applied to the root organizational unit in AWS Organizations can centrally enforce encryption requirements for all S3 buckets across every member account. By denying S3 actions (such as s3:PutObject) unless the request includes encryption parameters (e.g., x-amz-server-side-encryption), the SCP acts as a guardrail that cannot be overridden by account-level IAM policies, ensuring compliance without per-account configuration.

Answer

Configure an IAM role in the master account to enforce encryption via cross-account access.

Answer

Create an IAM policy in each account that denies s3:PutObject without encryption.

Answer

Use AWS CloudFormation StackSets to deploy a bucket policy to each account.

Question 15

A SysOps administrator needs to grant a developer access to view only the logs of a specific Amazon RDS instance. Which IAM action should be allowed?

Accepted Answer

rds:DownloadDBLogFilePortion. `rds:DownloadDBLogFilePortion` grants permission to download and view the contents of a log file for a specific RDS instance. The question asks for the action to 'view only the logs', which requires retrieving the log file content. `rds:DescribeDBLogFiles` only lists available log files, not the actual log data. Therefore, to view logs, the developer needs the `DownloadDBLogFilePortion` permission.

Answer

rds:DescribeDBInstances

Answer

rds:DescribeDBLogFiles

Answer

rds:DescribeEvents