SOA-C02 Security and Compliance Practice Test 17 — 15 Questions

Question 1

A company's security team notices that an IAM user has been making unauthorized API calls from an IP address outside the company's VPN. The team wants to immediately block all API calls from that specific IP address for all users. Which action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the root organizational unit.. A service control policy (SCP) attached to the root organizational unit (OU) applies to all accounts in the organization, effectively blocking API calls from the specified IP for all IAM users and roles across those accounts. Option A is incorrect because attaching an IAM policy to all users only affects the current account and is not scalable for organization-wide enforcement. Option B is incorrect because IAM policies cannot be attached to an organization root; only SCPs can be applied at that level. Option D is incorrect because SCPs cannot be attached directly to IAM users; they apply to OUs or accounts.

Answer

Create a new IAM policy that denies access from the IP address and attach it to all users.

Answer

Create an IAM policy that denies access from the IP address and attach it to the organization root.

Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the IAM user.

Question 2

A company stores sensitive data in an RDS database. Which AWS service should be used to encrypt the database at rest?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) provides encryption keys that can be used to enable encryption at rest for Amazon RDS databases. Option A is incorrect because AWS Certificate Manager (ACM) is used for managing SSL/TLS certificates, not for encryption at rest. Option B is incorrect because AWS Identity and Access Management (IAM) manages user identities and permissions, not encryption keys. Option D is incorrect because AWS CloudHSM provides hardware security modules but is not the primary service used for RDS encryption; KMS is the simpler and recommended service for RDS encryption.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM

Question 3

Refer to the exhibit. An IAM policy is attached to a user. Which statement about the user's access is correct?

Accepted Answer

The user can get objects only over HTTPS.. The GetObject action has a condition requiring SecureTransport to be true, meaning only HTTPS is allowed. Option A is incorrect because HTTP is not allowed for GetObject. Option B is incorrect because ListBucket does not have the SecureTransport condition, so HTTP is allowed for listing objects. Option C is incorrect because listing objects is allowed over HTTP.

Answer

The user can get objects over HTTP.

Answer

The user can list objects in the bucket over HTTP.

Answer

The user can list objects only over HTTPS.

Question 4

A company uses IAM roles to grant EC2 instances access to S3 buckets. After a recent security audit, the SysOps administrator must ensure that only instances with a specific tag (Environment=Production) can assume the role. How can this be achieved?

Accepted Answer

Add a condition in the role's trust policy that checks for the instance's tag using the aws:ResourceTag condition key.. IAM role trust policies can use the aws:ResourceTag condition key to restrict which EC2 instances (based on their tags) can assume the role. Option A is wrong because tags are not automatically included in the session; the trust policy must explicitly check tags. Option B is wrong because SCPs apply to accounts, not instances. Option C is wrong because instance profiles cannot be modified to check tags.

Answer

Create a new IAM role for each instance and attach the tag.

Answer

Use a service control policy (SCP) to deny the ec2:AssumeRole action for instances without the required tag.

Answer

Modify the instance profile to include the tag requirement.

Question 5

A company wants to provide temporary credentials to an application running on an on-premises server so it can access AWS resources. The credentials must be rotated automatically. Which IAM feature should be used?

Accepted Answer

Use IAM Roles Anywhere with a certificate authority to issue temporary credentials.. IAM Roles Anywhere allows workloads running outside of AWS, such as on-premises servers, to assume IAM roles and obtain temporary credentials using X.509 certificates. The credentials are automatically rotated by the service. Option A is wrong because an EC2 instance profile can only be used for EC2 instances, not on-premises servers. Option B is wrong: SAML 2.0 federation is typically used for federating user identities (e.g., SSO), not for application or machine identities. Option C is wrong because IAM users with programmatic access have long-term access keys that do not rotate automatically.

Answer

Use an EC2 instance profile and attach it to the on-premises server.

Answer

Configure a SAML 2.0 identity provider and federate the application.

Answer

Create an IAM user with programmatic access and share the access key.

Question 6

A SysOps administrator is troubleshooting an issue where an IAM user can launch EC2 instances but cannot terminate them. The user's permissions are based on an IAM group policy. Which action should the administrator take to resolve this?

Accepted Answer

Review and modify the IAM group policy to include ec2:TerminateInstances action. The administrator should review the group policy to ensure it includes ec2:TerminateInstances. The issue is likely a missing action in the policy, not a service control policy (SCP) or session policy issue, and simply adding the user to a new group won't fix the underlying policy gap.

Answer

Attach a managed policy that includes ec2:TerminateInstances directly to the user

Answer

Add the user to a different IAM group that has the required permissions

Answer

Check the user's permissions boundary for any restrictions

Question 7

A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS with a specific customer managed key. Which bucket policy condition should be used to enforce this?

Accepted Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms", "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}. It uses both conditions: 's3:x-amz-server-side-encryption' set to 'aws:kms' ensures that objects are encrypted with SSE-KMS, and 's3:x-amz-server-side-encryption-aws-kms-key-id' set to the specific key ARN ensures that only the designated customer managed key is used. Option A enforces KMS encryption but does not restrict which KMS key, allowing any managed key. Option C enforces a specific key ARN but does not require the encryption header to be present, which could allow objects without encryption if the key ID header is omitted (though in practice, the key ID is only valid with SSE-KMS, the condition alone is not sufficient to guarantee encryption). Option D uses a 'Null' condition incorrectly and would not properly enforce encryption.

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}

Answer

"Condition": {"Null": {"s3:x-amz-server-side-encryption": "false"}}

Question 8

A SysOps administrator notices that an EC2 instance running a web server is receiving unexpected traffic from an IP address that is known to be malicious. The administrator wants to block this IP address at the instance level. Which solution should be used?

Accepted Answer

Install a third-party firewall on the instance.. A host-based firewall (such as a third-party firewall installed on the instance) can block traffic from a specific IP address at the instance level. Option A is incorrect because network ACLs operate at the subnet level, not the instance level. Option B is incorrect because AWS WAF is designed to filter web requests at the application layer and is typically associated with load balancers or CloudFront, not directly with an individual EC2 instance. Option D is incorrect because security groups do not support deny rules; they only allow traffic, so they cannot be used to block specific IPs.

Answer

Modify the network ACL to deny traffic from that IP.

Answer

Use AWS WAF to block the IP address.

Answer

Update the security group to deny traffic from that IP.

Question 9

A company is using AWS KMS to encrypt data. The security team wants to ensure that a specific IAM role can use a KMS key, but only when the request comes from a specific VPC. Which THREE conditions should be included in the KMS key policy? (Choose three.)

Accepted Answer

aws:SourceVpc equals the VPC ID.. The aws:SourceArn condition key is used to restrict access based on the ARN of the resource that is the source of the request, such as an S3 bucket or Lambda function; it is not appropriate for restricting access to a specific IAM role ARN. Therefore, option B is incorrect. Option C is correct: aws:SourceVpc restricts use to requests originating from a specific VPC. Option E is correct: aws:SourceVpce restricts use to requests coming through a specific VPC endpoint. Option A is incorrect because aws:SourceSubnet is not a valid condition key. Option D is incorrect because aws:SourceIp restricts based on IP address, which does not reliably correspond to a VPC (for example, traffic through a NAT gateway would appear from the NAT’s IP).

Answer

aws:SourceSubnet equals the subnet ID.

Answer

aws:SourceArn equals the IAM role ARN.

Answer

aws:SourceIp equals the VPC CIDR.

Question 10

A company stores sensitive data in an S3 bucket. The security team requires that all objects uploaded to the bucket be encrypted at rest using an AWS KMS customer-managed key. Which S3 bucket policy statement should be added to enforce this requirement?

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. It denies any PutObject request that does not use KMS encryption (s3:x-amz-server-side-encryption != 'aws:kms') OR that does not include a KMS key ID (s3:x-amz-server-side-encryption-aws-kms-key-id is null). This enforces that objects are encrypted with a KMS customer-managed key. Option A is incorrect because it denies only if encryption is not KMS, but allows KMS without requiring a key ID, which could permit using the default AWS-managed KMS key rather than a customer-managed key. Option B is incorrect because it denies only if no encryption header is present, but allows any encryption type including SSE-S3 or SSE-KMS without a key ID. Option D is incorrect because it denies encryption that is not AES256, which is SSE-S3, and would incorrectly allow SSE-KMS.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Question 11

A company uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. Which configuration step is required?

Accepted Answer

Configure the target group to use HTTPS protocol and install SSL/TLS certificates on the instances.. Configuring the target group to use the HTTPS protocol ensures that the ALB encrypts traffic to the instances using SSL/TLS. The instances must have valid certificates installed to terminate the HTTPS connection. Option A is incorrect because the ALB listener handles encryption between clients and the ALB, not between the ALB and instances. Option C is incorrect because placing instances in a private subnet and using a NAT gateway affects outbound internet access, not encryption between the ALB and instances. Option D is incorrect because a security group rule can allow only HTTPS traffic, but it does not enforce encryption; the traffic protocol must also be HTTPS.

Answer

Configure the ALB listener to use HTTPS with a security policy.

Answer

Place the instances in a private subnet and use a NAT gateway for outbound traffic.

Answer

Create a security group rule that allows only HTTPS traffic from the ALB to the instances.

Question 12

Refer to the exhibit. An IAM user has this policy attached. What is the effect when the user attempts to get an object from my-bucket from an IP address in the range 198.51.100.0/24?

Accepted Answer

Denied because the Deny statement applies. The policy includes an Allow statement that grants s3:GetObject only from the IP range 192.0.2.0/24. It also includes a Deny statement that denies s3:GetObject from any IP address not in that range (using the NotIpAddress condition). The user's request comes from an IP in the 198.51.100.0/24 range, which is not included in the allowed range. Therefore, the Deny condition matches, and the Deny statement applies. In AWS IAM, an explicit Deny overrides any Allow, so the request is denied. Option D is correct. Option A is incorrect because the Deny does match. Option B is incorrect because there is an explicit Allow for a different IP range, but the Deny overrides it. Option C is incorrect because the Allow only applies to the specified range, and the Deny overrides it.

Answer

Allowed because the Deny condition does not match

Answer

Denied because there is no explicit Allow for that IP range

Answer

Allowed because there is an Allow statement

Question 13

A company uses AWS CloudTrail to log API activity. The security team needs to be alerted when an IAM user creates a new access key. Which combination of services should the SysOps administrator use to meet this requirement?

Accepted Answer

A CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification. CloudWatch Events (now Amazon EventBridge) can match CloudTrail events (like CreateAccessKey) and trigger an SNS notification. Option A is wrong because CloudWatch Logs Insights is a query tool for analyzing logs, not a real-time alerting mechanism; although metric filters and alarms can be set up, CloudWatch Events provides a more direct solution. Option B is wrong because AWS Config rules evaluate resource configurations and compliance, not real-time API calls. Option D is wrong because S3 event notifications trigger on object-level events in S3 buckets, not on specific API calls within CloudTrail logs.

Answer

CloudWatch Logs Insights query on CloudTrail logs with an alarm

Answer

An AWS Config rule that checks for new access keys and sends an SNS notification

Answer

S3 event notifications to an SNS topic

Question 14

A company needs to comply with PCI DSS requirements for its AWS environment. Which TWO services should the SysOps administrator use to automate compliance checks and generate reports? (Choose TWO.)

Accepted Answer

AWS Config. (AWS Config) is correct because AWS Config provides managed rules that evaluate resource configurations against compliance standards like PCI DSS, and can trigger auto-remediation or generate compliance reports via AWS Config conformance packs. Option E (AWS Audit Manager) is correct because it helps continuously audit your AWS usage, automate evidence collection, and generate compliance reports for PCI DSS. Option A (Amazon CloudWatch) is incorrect because it is focused on monitoring metrics and logs, not on compliance checks or automated reporting. Option C (AWS CloudTrail) is incorrect because it records API activity for auditing but does not perform compliance checks or generate compliance reports. Option D (AWS Trusted Advisor) is incorrect because it provides best-practice recommendations but does not automate compliance checks or generate detailed compliance reports required by PCI DSS.

Answer

Amazon CloudWatch

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 15

A company uses S3 to store sensitive data. To meet compliance requirements, all S3 buckets must be encrypted at rest. The security team notices that some objects in a bucket are not encrypted. What is the MOST efficient way to enforce encryption for all future objects?

Accepted Answer

Create an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption header is not present. A bucket policy that denies PutObject unless the `x-amz-server-side-encryption` header is present enforces encryption at the API level, preventing any unencrypted object from being uploaded. This is the most efficient approach as it proactively blocks non-compliant uploads without requiring post-upload remediation or manual intervention.

Answer

Use AWS Config managed rule to identify unencrypted objects and re-upload them manually

Answer

Use S3 Inventory to list unencrypted objects and apply encryption via S3 Batch Operations

Answer

Enable default encryption on the bucket using AES-256