SOA-C02 Security and Compliance Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user. What is the effective permission regarding the s3:DeleteObject action on the example-bucket?

Accepted Answer

Denied because of the explicit Deny statement. In IAM, an explicit Deny overrides any Allow. So even though the first statement allows all S3 actions, the second statement explicitly denies DeleteObject. Thus DeleteObject is denied. Option B is correct. Options A, C, D are incorrect because Deny prevails.

Answer

Denied because the action is not allowed explicitly

Answer

Allowed because the Allow statement is listed first

Answer

Allowed because the Deny statement has a typo

Question 2

Refer to the exhibit. A SysOps administrator runs the commands shown. Which key(s) have automatic key rotation enabled?

Accepted Answer

Only the first key. The output shows that key 1234abcd-12ab-34cd-56ef-1234567890ab has KeyRotationEnabled set to true, so it has automatic rotation enabled. Key 0987fedc-87fe-65dc-43ba-abcdef123456 has false. Option A is correct. Options B, C, D are incorrect.

Answer

Only the second key

Answer

Neither key

Answer

Both keys

Question 3

Refer to the exhibit. An IAM policy allows running instances. A user attempts to launch a t2.micro instance with a 20 GiB gp2 volume and an additional 100 GiB io1 volume. What will happen?

Accepted Answer

The launch succeeds. The policy allows running t2.micro instances (first statement) and creating volumes (second statement) without restriction on volume type or size. However, the condition on the instance resource only restricts the instance type to t2.micro; the volume resource has no condition. Therefore, both volumes are allowed. The instance launch succeeds. Option A is correct. Options B, C, D are incorrect.

Answer

The launch fails because the policy does not allow creating volumes over 100 GiB

Answer

The launch fails because the condition does not allow any volume

Answer

The launch fails because the io1 volume is not allowed

Question 4

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should be used to track these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls, including IAM policy changes. Option B is correct. Option A is wrong because AWS Config records resource configuration but not API calls. Option C is wrong because CloudWatch is for monitoring metrics. Option D is wrong because Trusted Advisor provides best practice checks.

Answer

AWS Config

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Question 5

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all S3 buckets across all accounts have encryption enabled. What is the most efficient way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies S3 actions without encryption.. Option D is correct because using a service control policy (SCP) in AWS Organizations allows you to centrally enforce permissions across all accounts. Option A is wrong because SCPs are the tool for this, not individual account policies. Option B is wrong because CloudFormation StackSets would require manual deployment. Option C is wrong because IAM roles don't enforce bucket encryption.

Answer

Configure an IAM role in the master account to enforce encryption via cross-account access.

Answer

Create an IAM policy in each account that denies s3:PutObject without encryption.

Answer

Use AWS CloudFormation StackSets to deploy a bucket policy to each account.

Question 6

A SysOps administrator needs to grant a developer access to view only the logs of a specific Amazon RDS instance. Which IAM action should be allowed?

Accepted Answer

rds:DescribeDBLogFiles. Option A is correct because rds:DescribeDBLogFiles lists the available log files for an RDS instance. Option B is wrong because rds:DownloadDBLogFilePortion downloads a log file, not just view. Option C is wrong because rds:DescribeDBInstances describes instance details, not logs. Option D is wrong because rds:DescribeEvents describes events, not logs.

Answer

rds:DownloadDBLogFilePortion

Answer

rds:DescribeDBInstances

Answer

rds:DescribeEvents

Question 7

A company has an S3 bucket configured with default encryption using SSE-S3. Users report that objects uploaded without specifying encryption are still encrypted, but some objects are accessible to unauthorized users. What is the most likely cause?

Accepted Answer

The bucket policy does not restrict access based on user permissions.. Option B is correct because default encryption only encrypts objects, it does not enforce access policies. Option A is wrong because bucket policies are needed for access control. Option C is wrong because enabling MFA Delete is about deletion, not access. Option D is wrong because public access block prevents public access, but the issue is unauthorized access from within the account or cross-account.

Answer

The bucket policy is not configured to deny unencrypted uploads.

Answer

The bucket does not have MFA Delete enabled.

Answer

The bucket's block public access settings are not configured.

Question 8

A SysOps administrator notices that an Amazon CloudWatch Logs log group is growing rapidly and suspects that an EC2 instance is sending sensitive data to the logs. What is the most effective way to detect and redact sensitive data in real-time?

Accepted Answer

Create a CloudWatch Logs subscription filter that invokes a Lambda function for redaction.. Option D is correct because CloudWatch Logs subscription filters can send logs to Lambda for real-time processing, including redaction. Option A is wrong because CloudWatch Logs Insights is for querying, not real-time redaction. Option B is wrong because Kinesis Data Firehose can transform data but requires a Lambda function for custom redaction. Option C is wrong because S3 event notifications are not real-time for log streams.

Answer

Use CloudWatch Logs Insights to query and mask sensitive data.

Answer

Enable S3 event notifications to trigger a Lambda function for redaction.

Answer

Send logs to Amazon Kinesis Data Firehose and use Lambda for redaction.

Question 9

A company wants to allow an external auditor to assume an IAM role in their AWS account to review resources. What is the minimum information the auditor needs from the company to do this?

Accepted Answer

The Amazon Resource Name (ARN) of the IAM role to assume.. Option C is correct because the auditor needs the role ARN to assume the role. Option A is wrong because the IAM user name is for direct access, not role assumption. Option B is wrong because the account ID alone is insufficient. Option D is wrong because the IAM policy is not needed; the auditor's account must have permissions.

Answer

The IAM user name and password of the company's admin user.

Answer

The IAM policy document that grants the auditor access.

Answer

The AWS account ID and the region where resources are hosted.

Question 10

A company uses AWS KMS to encrypt EBS volumes attached to EC2 instances. The security team wants to ensure that only specific IAM roles can decrypt the volumes. Which configuration meets this requirement?

Accepted Answer

Modify the KMS key policy to allow only specific IAM roles to use kms:Decrypt.. Option D is correct because a key policy in KMS can define which IAM roles can use the key for decryption. Option A is wrong because instance profiles do not control decrypt permissions. Option B is wrong because bucket policies are for S3, not EBS. Option C is wrong because SCPs can restrict but are not granular for specific roles.

Answer

Use a service control policy to deny kms:Decrypt for all users.

Answer

Apply a bucket policy on the EBS snapshot bucket.

Answer

Attach an instance profile with a policy that denies ec2:DetachVolume.

Question 11

A SysOps administrator needs to audit all IAM user activity in the AWS account for the last 90 days. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls including IAM actions for the last 90 days by default in the event history. Option A is wrong because AWS Config records resource configuration changes, not user activity. Option B is wrong because Amazon GuardDuty is for threat detection. Option D is wrong because AWS Trusted Advisor is for cost optimization and best practices.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 12

A company wants to provide temporary security credentials to a mobile application so it can access an S3 bucket. Which AWS service should be used to issue these credentials?

Accepted Answer

AWS Security Token Service (STS). Option A is correct because AWS STS (Security Token Service) generates temporary credentials. Option B is wrong because IAM users have long-term credentials. Option C is wrong because Amazon Cognito can issue credentials but is typically used for user pools; STS is the direct service. Option D is wrong because KMS is for encryption keys.

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Question 13

A SysOps administrator is asked to ensure that all objects in an S3 bucket are encrypted at rest using a customer-managed KMS key. The bucket currently has default encryption set to SSE-S3. What must be done to meet the requirement?

Accepted Answer

Update the bucket's default encryption to SSE-KMS using the customer-managed key, and re-upload existing objects.. Option B is correct because changing the default encryption to SSE-KMS with the customer key will encrypt new objects. Existing objects must be copied to re-encrypt with the new key. Option A is wrong because bucket policies can enforce encryption but do not change default encryption. Option C is wrong because SCPs are not for bucket-level settings. Option D is wrong because enabling versioning does not change encryption.

Answer

Add a bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.

Answer

Apply a service control policy to enforce SSE-KMS across the organization.

Answer

Enable S3 Versioning and set the bucket's default encryption to SSE-KMS.

Question 14

A company's security team requires that all API calls to AWS services are encrypted in transit using TLS 1.2 or higher. Which TWO actions should be taken to enforce this?

Accepted Answer

Use AWS CloudTrail to monitor for API calls using TLS 1.0 and generate alerts.. Option A and Option E are correct. Using an SCP that denies requests without TLS 1.2 and using CloudTrail to monitor for non-compliant requests are effective. Option B is wrong because IAM policies cannot enforce protocol versions. Option C is wrong because enforcing HTTPS only is not enough; TLS version matters. Option D is wrong because EC2 security groups control network traffic, not API calls.

Answer

Enable AWS CloudTrail to log all API calls.

Answer

Configure EC2 security groups to only allow HTTPS traffic.

Answer

Create an IAM policy that denies access unless the request uses TLS 1.2.

Question 15

A company needs to restrict access to an S3 bucket so that only users from a specific VPC can read objects. Which THREE configurations are required?

Accepted Answer

Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.. Options A, B, and D are correct. A bucket policy with a condition for vpc:SourceVpce, a VPC endpoint for S3, and the route table updates are required. Option C is wrong because S3 does not require a security group for VPC endpoints; network ACLs are not needed. Option E is wrong because IAM users alone do not restrict by VPC.

Answer

Create IAM users and assign them permissions to access the bucket.

Answer

Attach a security group to the S3 bucket.

SOA-C02 Security and Compliance Practice Test 16 — 15 Questions

Exhibit

SOA-C02 Security and Compliance Practice Test 16 — 15 Questions

Exhibit