SOA-C02 Security and Compliance Practice Test 2 — 15 Questions

Question 1

A company uses IAM roles to grant EC2 instances access to S3 buckets. After a recent security audit, the SysOps administrator must ensure that only instances with a specific tag (Environment=Production) can assume the role. How can this be achieved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a condition in the role's trust policy that checks for the instance's tag using the aws:ResourceTag condition key.. EC2 instance roles are assumed via the instance metadata service, and the role's trust policy can include a condition using the aws:ResourceTag condition key to require that the instance bears the Environment=Production tag. This enforces tag-based access control at the AssumeRole boundary without creating per-instance roles.

Answer

Create a new IAM role for each instance and attach the tag.

Answer

Use a service control policy (SCP) to deny the ec2:AssumeRole action for instances without the required tag.

Answer

Modify the instance profile to include the tag requirement.

Question 2

An organization uses AWS KMS to encrypt data in S3. A SysOps administrator needs to ensure that KMS keys cannot be deleted accidentally. What is the MOST effective way to protect against accidental key deletion?

Accepted Answer

Set a high waiting period (e.g., 30 days) for key deletion and require multi-factor authentication (MFA) for the deletion.. The most effective protection against accidental KMS key deletion is to set a long waiting period (up to 30 days) and require MFA for the deletion operation. The waiting period gives administrators a window to cancel a scheduled deletion, and MFA adds a strong authentication barrier so a compromised credential alone cannot delete the key.

Answer

Disable the KMS key so it cannot be used but can still be deleted.

Answer

Create a backup of the KMS key in another AWS Region.

Answer

Use a service control policy (SCP) to deny the kms:ScheduleKeyDeletion action.

Question 3

A SysOps administrator receives an alert that an IAM user's access key was used from an unexpected geographic location. What should the administrator do to prevent future unauthorized use?

Accepted Answer

Add a condition to the IAM user's policy that denies access from outside the expected region. Adding an IAM policy condition that denies access from outside the expected region directly addresses the root cause — the access key was used from an unexpected geographic location. IAM policy conditions using aws:RequestedRegion or aws:SourceIp can restrict where credentials are valid, preventing future unauthorized geographic use without disrupting legitimate access. This is the least disruptive, most targeted remediation for the stated problem.

Answer

Disable the IAM user's account immediately

Answer

Enable multi-factor authentication (MFA) for the IAM user

Answer

Delete the IAM user's access key and create a new one

Question 4

A SysOps administrator needs to securely transfer a large dataset from an on-premises server to an Amazon S3 bucket. The data is sensitive and must be encrypted in transit and at rest. Which THREE steps should the administrator take? (Choose three.)

Accepted Answer

Create an S3 endpoint policy that only allows access from the on-premises IP range. To securely transfer data, you should enable S3 bucket-side encryption (SSE-KMS or SSE-S3) for encryption at rest, use an S3 endpoint policy to restrict access (e.g., only allow from specific VPC), and use AWS CLI with --sse flag to enforce server-side encryption during upload. While HTTPS is mandatory, it's implicitly used; the explicit steps are the other three. Using public endpoints would expose data; disabling HTTPS would break encryption in transit.

Answer

Disable public access to the S3 bucket

Answer

Use an S3 bucket policy that denies requests unless they are made over HTTPS

Question 5

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files from the S3 bucket. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable CloudTrail log file validation. Option C is correct because an SCP attached to the relevant OUs or the organization root can explicitly deny cloudtrail:StopLogging and cloudtrail:DeleteTrail, preventing any principal in member accounts from disabling or deleting the trail even if they have IAM permissions. Option E is correct because an S3 bucket policy that denies s3:DeleteObject on the CloudTrail log bucket blocks deletion of the log objects themselves, protecting the audit data at the resource level. Option A is correct because enabling CloudTrail log file validation creates a digest file with a digital signature for each log file, allowing you to verify that logs have not been altered or deleted after delivery. Option B is not required for preventing disabling or deletion; sending logs to CloudWatch Logs only provides real-time monitoring and does not stop StopLogging, DeleteTrail, or object deletion. Option D is not sufficient by itself and is not one of the required three actions; MFA delete adds protection against accidental or unauthorized bucket versioning changes and object deletions but does not prevent disabling CloudTrail or deleting trails, and it is not the specified control for this scenario.

Answer

Send CloudTrail logs to CloudWatch Logs for real-time monitoring

Answer

Enable MFA delete on the S3 bucket

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets in the organization have server-side encryption enabled. What is the MOST efficient way to achieve this?

Accepted Answer

Attach a service control policy (SCP) that denies s3:PutBucketEncryption and s3:CreateBucket actions unless encryption is specified.. Service control policies (SCPs) can be applied to the root OU or specific accounts to deny s3:PutBucketEncryption and s3:CreateBucket actions unless encryption is specified. This proactively prevents any bucket from being created or modified without server-side encryption, enforcing encryption across the entire organization. Option B is incorrect because Trusted Advisor only provides checks and notifications; it does not enforce encryption. Option C is incorrect because AWS Config rules can detect non-compliant buckets but require additional setup like auto-remediation, and they are not as efficient as SCPs for prevention. Option D is incorrect because bucket policies are applied per bucket and cannot be enforced globally across all accounts.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets and notify the account owners.

Answer

Use AWS Config rules to automatically remediate non-compliant buckets.

Answer

Apply a bucket policy to each bucket requiring server-side encryption for all uploads.

Question 7

A SysOps administrator needs to provide temporary access to an S3 bucket for a third-party auditor. The access must expire after 24 hours. Which solution should the administrator use?

Accepted Answer

Use AWS Security Token Service (STS) to issue temporary credentials that expire after 24 hours.. AWS STS can issue temporary credentials with a configurable expiration, in this case 24 hours, which aligns with the requirement for temporary access that expires. Option A is incorrect because creating an IAM user provides long-term credentials, not temporary. Option B is incorrect because a bucket policy granting access to the auditor's AWS account provides persistent access unless explicitly revoked, and it does not inherently expire. Option D is incorrect because a pre-signed URL grants access to a specific object, not the entire bucket, and the question requires access to the S3 bucket as a whole.

Answer

Create an IAM user for the auditor and attach a policy granting access to the bucket.

Answer

Create a bucket policy that grants access to the auditor's AWS account.

Answer

Generate a pre-signed URL for the bucket.

Question 8

A company uses an IAM policy to allow users to manage their own passwords and access keys. The policy includes a condition that requires multi-factor authentication (MFA) for any sensitive operations. However, users report that they are unable to change their own passwords even when MFA is not required. What is the likely cause?

Accepted Answer

The condition key aws:MultiFactorAuthPresent is set to true, preventing password changes without MFA.. The condition key aws:MultiFactorAuthPresent is set to true, which requires MFA for the action. If this condition is applied to iam:ChangePassword, users without MFA cannot change passwords. Option A is incorrect because aws:MultiFactorAuthAge checks the age of MFA, not presence. Option B is incorrect because missing iam:ChangePassword would prevent all password changes, not just those without MFA. Option C is incorrect because group vs user attachment does not affect condition evaluation; the policy still applies.

Answer

The condition key aws:MultiFactorAuthAge is set incorrectly.

Answer

The policy does not include the iam:ChangePassword action.

Answer

The policy is attached to a group instead of the user.

Question 9

A company wants to ensure that data in transit between an EC2 instance and an RDS database is encrypted. Which TWO actions should the SysOps administrator take? (Choose TWO.)

Accepted Answer

Enable SSL/TLS for the RDS DB instance.. To encrypt data in transit between an EC2 instance and an RDS database, two actions are required: enabling SSL/TLS on the RDS DB instance (option B) and configuring the application to use SSL/TLS when connecting to the database (option E). The database must accept SSL connections, and the client must initiate them. Option A (VPC peering) does not encrypt traffic; it only provides network connectivity. Option C (VPN) adds encryption but is unnecessary when SSL/TLS is used within the same VPC. Option D (encryption at rest) protects data stored on disk, not data in transit.

Answer

Use VPC peering to connect the EC2 instance and RDS database.

Answer

Set up a VPN connection between the EC2 instance and the RDS database.

Answer

Enable encryption at rest for the RDS DB instance.

Question 10

A company has an AWS account with multiple IAM users. The security team wants to enforce that all users use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should the SysOps administrator take? (Choose THREE.)

Accepted Answer

Enable MFA for each IAM user in the AWS Management Console.. To enforce MFA for all IAM users, the administrator must enable MFA for each user (B), create an IAM policy that denies console access unless MFA is present (C), and educate users on how to set up and use MFA devices (E). Option A is incorrect because service control policies (SCPs) are used in AWS Organizations and do not directly enforce MFA on IAM users in a single account. Option D is incorrect because AWS CloudTrail is a monitoring service and does not enforce MFA requirements.

Answer

Attach a service control policy (SCP) to the account to require MFA.

Answer

Use AWS CloudTrail to monitor user logins and disable accounts without MFA.

Question 11

A company wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which TWO steps should be taken? (Choose two.)

Accepted Answer

Create an IAM policy that denies access without MFA.. Option B is correct because an IAM policy with a Deny effect conditioned on aws:MultiFactorAuthPresent being false (e.g., "Condition": {"BoolIfExists": {"aws:MultiFactorAuthPresent": "false"}}) enforces that IAM users cannot access console resources unless they have authenticated with MFA. Option C is correct because each IAM user must actually have an MFA device registered (virtual MFA app, hardware TOTP token, or FIDO2 security key) via the IAM console or aws iam enable-mfa-device, since the policy only enforces MFA if a device exists. Option A is not correct because CloudTrail only logs and audits API activity such as MFA-related events; it does not enforce MFA. Option D is not correct because AWS does not provide an account-level MFA toggle that forces MFA for all IAM users; MFA is configured per IAM user (or via identity federation). Option E is not correct because a role trust policy governs who can assume a role (with sts:AssumeRole and conditions like aws:MultiFactorAuthPresent), not console sign-in for IAM users.

Answer

Use AWS CloudTrail to monitor MFA usage.

Answer

Enable MFA at the AWS account level.

Answer

Modify the IAM role trust policy to require MFA.

Question 12

A company is using AWS KMS to encrypt data. The security team wants to ensure that a specific IAM role can use a KMS key, but only when the request comes from a specific VPC. Which THREE conditions should be included in the KMS key policy? (Choose three.)

Accepted Answer

aws:SourceVpc equals the VPC ID.. The question asks for conditions in a KMS key policy that restrict use of the key to requests originating from a specific VPC. Option C, aws:SourceVpc equals the VPC ID, is correct because aws:SourceVpc is the standard global condition key that matches the VPC ID from which the request is made, allowing the policy to allow only requests originating inside that VPC. Option E, aws:SourceVpce equals the VPC endpoint ID, is correct because aws:SourceVpce restricts access to requests that come through a specific VPC endpoint, which is the recommended way to scope KMS access to a particular VPC endpoint. Option A is not correct because aws:SourceSubnet is not a valid AWS global condition key for KMS key policies, and subnet-level restrictions are not supported this way. Option B is not correct because aws:SourceArn is used to match the ARN of the resource making the request (for example in service-to-service calls), not the IAM role ARN, and the role is already specified as the principal in the key policy. Option D is not correct because aws:SourceIp matches a public source IP address or CIDR, not a VPC CIDR, and VPC-internal requests do not present the VPC CIDR as a source IP.

Answer

aws:SourceSubnet equals the subnet ID.

Answer

aws:SourceArn equals the IAM role ARN.

Answer

aws:SourceIp equals the VPC CIDR.

Question 13

A SysOps administrator applies the IAM policy shown in the exhibit to an IAM user. The user tries to upload an object to the S3 bucket without specifying encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. The IAM policy includes a condition that requires the `s3:x-amz-server-side-encryption` header to be present and set to a valid encryption algorithm (e.g., SSE-S3 or SSE-KMS). Since the user does not specify any encryption in the upload request, the condition is not met, and the `s3:PutObject` action is denied. Therefore, the upload fails with an Access Denied error. Option C is correct. Options A, B, and D are incorrect because the policy denies unencrypted uploads, regardless of default bucket settings.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-KMS encryption.

Answer

The upload succeeds with default encryption.

Question 14

A SysOps administrator is investigating an unauthorized stop of an EC2 instance. The CloudTrail log entry shows the event. What is the first step to determine if the action was authorized?

Accepted Answer

Check the IAM permissions of the user 'Admin' at the time of the event.. The first step in determining whether an EC2 stop action was authorized is to examine the IAM permissions of the principal (user 'Admin') at the time of the event — if the identity lacked ec2:StopInstances permission, the action was unauthorized. CloudTrail records the API call and the identity, but authorization is determined by IAM policy evaluation. This directly answers whether the action was permitted.

Answer

Check the S3 bucket where CloudTrail logs are stored.

Answer

Verify the source IP address belongs to the company.

Answer

Check the EC2 instance's state change history.

Question 15

A company has an S3 bucket that stores sensitive customer data. The security team requires that all access to the bucket be logged for auditing. The SysOps administrator enabled S3 server access logging and configured the logs to be delivered to a different S3 bucket in the same account. However, after a week, the log bucket is empty. What is the most likely cause?

Accepted Answer

The log bucket has a bucket policy that denies access to the log delivery service.. The most likely cause is that the log delivery service is being denied by the destination bucket's bucket policy. S3 server access logs are delivered using a special log delivery service account (the S3 log delivery service). If the destination bucket has a bucket policy that explicitly denies PutObject actions for that service principal, logs will fail to be written. Option A is incorrect because lifecycle policies only affect object expiration/transition, not log delivery. Option B is incorrect because the ACL on the source bucket only controls access to the source bucket objects, not the ability of the log delivery service to write to the destination bucket. Option D is a possible cause because S3 server access logging requires the destination bucket to be in the same region as the source bucket; however, a region mismatch would prevent logs from being delivered at all, but the question states logs are empty after a week, and a bucket policy denial is a more common misconfiguration that can go unnoticed until logs are expected. Therefore, the most likely cause is a bucket policy on the destination bucket that denies the log delivery service.

Answer

The log bucket has no lifecycle policy.

Answer

The source bucket has an ACL that denies the log delivery service.

Answer

The log bucket is in a different region.