SOA-C02 Security and Compliance Practice Test 17 — 15 Questions

Question 1

A SysOps administrator notices that an Amazon CloudWatch Logs log group is growing rapidly and suspects that an EC2 instance is sending sensitive data to the logs. What is the most effective way to detect and redact sensitive data in real-time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch Logs subscription filter that invokes a Lambda function for redaction.. CloudWatch Logs subscription filters can invoke a Lambda function in real-time as log events are ingested. This allows the Lambda function to inspect, detect, and redact sensitive data (e.g., credit card numbers or passwords) before the logs are stored in the log group, meeting the requirement for real-time detection and redaction.

Answer

Use CloudWatch Logs Insights to query and mask sensitive data.

Answer

Enable S3 event notifications to trigger a Lambda function for redaction.

Answer

Send logs to Amazon Kinesis Data Firehose and use Lambda for redaction.

Question 2

A company wants to allow an external auditor to assume an IAM role in their AWS account to review resources. What is the minimum information the auditor needs from the company to do this?

Accepted Answer

The Amazon Resource Name (ARN) of the IAM role to assume.. To assume an IAM role, the auditor must know the role's ARN, which uniquely identifies the role (including the account ID and role name). The auditor then calls sts:AssumeRole with that ARN. The role's trust policy must also allow the auditor's AWS account or principal to assume it, but the ARN is the minimum information the auditor needs to initiate the call.

Answer

The IAM user name and password of the company's admin user.

Answer

The IAM policy document that grants the auditor access.

Answer

The AWS account ID and the region where resources are hosted.

Question 3

A company uses AWS KMS to encrypt EBS volumes attached to EC2 instances. The security team wants to ensure that only specific IAM roles can decrypt the volumes. Which configuration meets this requirement?

Accepted Answer

Modify the KMS key policy to allow only specific IAM roles to use kms:Decrypt.. KMS key policies allow you to specify which IAM roles are allowed to use the key for decryption. Option A is wrong because service control policies (SCPs) are used to set permission boundaries across accounts in an organization, but they are not the most direct way to restrict decryption for specific IAM roles; KMS key policies are more appropriate. Option B is wrong because EBS volumes do not have bucket policies; bucket policies apply to S3 buckets. Option D is wrong because instance profiles and policies denying ec2:DetachVolume do not affect decryption permissions.

Answer

Use a service control policy to deny kms:Decrypt for all users.

Answer

Apply a bucket policy on the EBS snapshot bucket.

Answer

Attach an instance profile with a policy that denies ec2:DetachVolume.

Question 4

A SysOps administrator needs to audit all IAM user activity in the AWS account for the last 90 days. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made by IAM users, including console sign-in events, CLI commands, and SDK actions, and retains these logs for up to 90 days by default in the event history. This allows the SysOps administrator to audit all IAM user activity over the last 90 days without additional configuration.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Question 5

A company wants to provide temporary security credentials to a mobile application so it can access an S3 bucket. Which AWS service should be used to issue these credentials?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is specifically designed to generate temporary security credentials for users and applications. Option A is incorrect: Amazon Cognito can issue temporary credentials via identity pools, but STS is the direct service for temporary credentials. Option B is incorrect: AWS KMS manages encryption keys, not credentials. Option D is incorrect: IAM manages long-term user credentials, not temporary ones.

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Question 6

A SysOps administrator is asked to ensure that all objects in an S3 bucket are encrypted at rest using a customer-managed KMS key. The bucket currently has default encryption set to SSE-S3. What must be done to meet the requirement?

Accepted Answer

Update the bucket's default encryption to SSE-KMS using the customer-managed key, and re-upload existing objects.. Default encryption on an S3 bucket only applies to newly uploaded objects; existing objects remain encrypted with the previous method (SSE-S3). To ensure all objects are encrypted at rest with a customer-managed KMS key, you must update the bucket's default encryption to SSE-KMS with the desired key and then re-upload (or copy) existing objects so they inherit the new encryption setting. Simply changing the default encryption does not retroactively re-encrypt objects already stored.

Answer

Add a bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.

Answer

Apply a service control policy to enforce SSE-KMS across the organization.

Answer

Enable S3 Versioning and set the bucket's default encryption to SSE-KMS.

Question 7

A company needs to restrict access to an S3 bucket so that only users from a specific VPC can read objects. Which THREE configurations are required?

Accepted Answer

Create a bucket policy that denies access unless the request comes from a specific VPC endpoint.. Option D is correct because an S3 gateway VPC endpoint must first exist in the specified VPC to give that VPC private connectivity to S3 and to provide the vpce ID that the bucket policy will reference. Option A is correct because the bucket policy must explicitly deny (or restrict) access unless requests arrive via that VPC endpoint, typically using the aws:sourceVpce condition key with the endpoint ID. Option B is correct because the VPC route table must have a route for the S3 prefix list (pl-xxxxxxxx) pointing to the gateway endpoint so that traffic from the VPC actually traverses the endpoint and satisfies the policy condition. Option C is not required because the scenario restricts access by network origin (VPC endpoint), not by individual IAM identities, and IAM users alone would not enforce the VPC restriction. Option E is not valid because security groups cannot be attached to S3 buckets; S3 access control uses bucket policies, IAM policies, ACLs, and endpoint policies instead.

Answer

Create IAM users and assign them permissions to access the bucket.

Answer

Attach a security group to the S3 bucket.

Question 8

A SysOps administrator needs to ensure that an Amazon RDS for MySQL database is compliant with PCI DSS requirements. Which THREE configurations should be implemented?

Accepted Answer

Require SSL/TLS connections to the database.. Option B is correct because PCI DSS requires strong cryptography for data in transit, and enforcing SSL/TLS on RDS for MySQL (via the require_secure_transport parameter or rds.force_ssl) ensures all client connections are encrypted. Option D is correct because PCI DSS mandates audit trails and monitoring of access to cardholder data; RDS audit logging (e.g., MySQL audit or general/slow query logs exported to CloudWatch Logs) captures database activity for review and forensics. Option E is correct because PCI DSS requires protection of stored cardholder data, and enabling encryption at rest with AWS KMS encrypts the underlying storage, snapshots, and read replicas. Option A is not a PCI DSS requirement—Multi-AZ provides high availability, not compliance controls. Option C is not required by PCI DSS; while backups support availability and retention, the specific 30-day automated backup retention is not a PCI DSS mandate.

Answer

Enable Multi-AZ deployment for high availability.

Answer

Configure automated backups with a retention period of 30 days.

Question 9

A SysOps administrator is managing a multi-account AWS environment using AWS Organizations. The security team has mandated that all Amazon S3 buckets across all accounts must be encrypted with SSE-KMS using a centrally managed KMS key. The administrator has created a KMS key in the master account and enabled key rotation. The key policy allows the root user of each member account to use the key. However, users in member accounts report that they cannot upload objects to their S3 buckets with SSE-KMS using the central key, even though they have s3:PutObject permissions. The administrator verifies that the KMS key policy includes the necessary permissions for the member accounts. What should the administrator do to resolve the issue?

Accepted Answer

Attach an IAM policy to the users/roles in the member accounts that allows kms:GenerateDataKey using the central KMS key.. Cross-account KMS usage requires permissions on both sides: the key policy must allow the external account, and the IAM principal in that account must also be granted kms:GenerateDataKey (and kms:Decrypt) via an IAM policy. The key policy alone is insufficient.

Answer

Create a new KMS key in each member account and configure S3 bucket default encryption accordingly.

Answer

Ensure that the KMS key policy allows the master account to administer the key.

Answer

Update the S3 bucket policy to allow the s3:PutObject action only when encryption is set to SSE-KMS.

Question 10

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive user data in an S3 bucket. The security team requires that traffic between the ALB and the EC2 instances be encrypted, and that the EC2 instances only accept traffic from the ALB. Currently, the ALB terminates HTTPS and forwards HTTP to the instances. The SysOps administrator needs to implement the required security controls. Which solution should the administrator implement?

Accepted Answer

Configure the target group to use HTTPS protocol, install a TLS certificate on the EC2 instances, and update the security group on the instances to allow inbound traffic only from the ALB's security group.. Configuring the target group to use HTTPS protocol ensures encryption between the ALB and EC2 instances. Installing a TLS certificate on the instances enables the ALB to establish a secure connection. Restricting the instances' security group to allow inbound traffic only from the ALB's security group ensures that only the ALB can reach the instances, meeting the requirement.

Answer

Use an AWS Global Accelerator to route traffic to the instances and enable encryption.

Answer

Create a network ACL that allows inbound HTTPS traffic from the ALB subnet and outbound HTTPS responses. Use AWS Certificate Manager to install a certificate on the instances.

Answer

Enable S3 VPC endpoint and configure the ALB to forward traffic to the instance via the endpoint.

Question 11

A company wants to securely store secrets such as database credentials and API keys used by applications running on Amazon EC2. Which AWS service should be used to manage and rotate these secrets automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to securely store, manage, and automatically rotate secrets such as database credentials and API keys. It integrates with AWS services like RDS, Redshift, and DocumentDB to provide built-in rotation. This makes it the correct choice for managing and rotating secrets automatically.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 12

A SysOps administrator needs to ensure that all Amazon S3 buckets in an AWS account are encrypted at rest using server-side encryption. Which combination of actions should be taken to enforce this policy?

Accepted Answer

Use an S3 bucket policy on each bucket that denies s3:PutObject if the x-amz-server-side-encryption header is not present.. An S3 bucket policy with a Deny statement for s3:PutObject that requires the x-amz-server-side-encryption header ensures that any PUT request without encryption headers is rejected. This enforces server-side encryption at the point of upload, preventing unencrypted objects from being stored in the bucket. Default encryption (Option A) only applies encryption to objects that are uploaded without encryption headers, but it does not prevent unencrypted uploads; a bucket policy denial is the only way to block them outright.

Answer

Enable default encryption on each S3 bucket and create a CloudWatch alarm to notify if unencrypted objects are uploaded.

Answer

Use an S3 bucket policy with a Deny statement for s3:PutObject without encryption applied to all buckets via a single policy.

Answer

Use AWS CloudTrail to monitor PutObject calls and trigger an AWS Lambda function to delete unencrypted objects.

Question 13

A company is using AWS Organizations with multiple accounts. The security team wants to prevent any IAM user from creating access keys for themselves across all accounts. What is the most effective way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that denies iam:CreateAccessKey to all accounts in the organization.. Service control policies (SCPs) are the most effective way to enforce a guardrail across all accounts in an AWS Organization because they allow you to centrally deny or restrict permissions at the root, OU, or account level, overriding any IAM policies attached to users or roles. By applying an SCP that denies iam:CreateAccessKey, the security team ensures that no IAM user in any account within the organization can create access keys, regardless of their individual IAM policies. This approach is scalable and cannot be bypassed by account administrators, making it the correct choice for organization-wide enforcement.

Answer

Attach an IAM policy to the root user that denies iam:CreateAccessKey.

Answer

Configure an IAM password policy that requires strong passwords.

Answer

Use AWS CloudTrail to monitor and alert on CreateAccessKey events.

Question 14

An application running on an Amazon EC2 instance needs to access an Amazon S3 bucket. The company security policy requires that credentials are not stored on the instance. What is the most secure way to grant access?

Accepted Answer

Create an IAM role with S3 access permissions and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance via an instance profile allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS). These credentials are automatically rotated and never stored on the instance, satisfying the security policy requirement. The EC2 instance retrieves the credentials through the instance metadata service (IMDS), eliminating the need for long-term access keys.

Answer

Generate an access key and secret key for an IAM user, then store them in a configuration file on the instance.

Answer

Create an S3 bucket policy that allows access from the instance's public IP address.

Answer

Define the access keys as environment variables in the user data script when launching the instance.

Question 15

A SysOps administrator needs to audit all changes to IAM policies in an AWS account. Which AWS service should be used to record these changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity in an AWS account, including all IAM policy changes such as creating, updating, or deleting policies. CloudTrail captures these events as JSON logs, which can be stored in an S3 bucket for auditing and analysis. This makes it the appropriate tool for auditing changes to IAM policies.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon S3