SOA-C02 Security and Compliance Practice Test 2 — 15 Questions

Question 1

A company's security policy requires that all Amazon EC2 instances must have a specific tag 'Environment' with a value of either 'Production' or 'Development'. The SysOps administrator needs to detect any instance that is missing this tag or has an invalid value, and automatically email the operations team. Which AWS service should be used to achieve this with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config with the 'required-tags' managed rule and Amazon SNS. AWS Config's 'required-tags' managed rule continuously evaluates EC2 instances against the specified tag key and allowed values, triggering an SNS notification when non-compliant resources are detected. This provides automated detection and alerting with minimal operational overhead, as it requires no custom code or infrastructure management.

Answer

Amazon CloudWatch Events with an EC2 instance state change rule and AWS Lambda

Answer

AWS Trusted Advisor with a custom check

Answer

Amazon Inspector with a network assessment

Question 2

A company wants to ensure that only specific IAM roles within the same AWS account can encrypt and decrypt data using an AWS KMS customer managed key. Which type of policy must be configured to achieve this restriction?

Accepted Answer

KMS key policy. A KMS key policy is the primary mechanism to control access to a customer managed key. By default, a KMS key policy must explicitly grant the necessary permissions (kms:Encrypt, kms:Decrypt) to IAM roles, and it can restrict those permissions to specific roles within the same account using the `aws:PrincipalArn` condition key. This ensures that only the designated IAM roles can encrypt and decrypt data with that key.

Answer

IAM policy attached to the roles

Answer

Service control policy (SCP)

Answer

Resource policy attached to the KMS key

Question 3

A SysOps administrator needs to detect when an IAM user attempts to modify an Amazon S3 bucket policy in the production AWS account. The administrator wants to receive an email notification within 5 minutes of such an event. The solution must use AWS managed services with no custom code. Which combination of services should the administrator use?

Accepted Answer

AWS CloudTrail, Amazon CloudWatch Events (Amazon EventBridge), and Amazon SNS. AWS CloudTrail captures the S3 bucket policy modification as a management event, which can be sent to Amazon EventBridge (formerly CloudWatch Events) as a real-time event. EventBridge can then trigger an SNS topic to send an email notification within minutes, all using fully managed services with no custom code required.

Answer

AWS CloudTrail, Amazon CloudWatch Logs metric filter, and Amazon SNS

Answer

Amazon S3 event notifications and Amazon SNS

Answer

AWS CloudTrail, AWS Lambda, and Amazon SNS

Question 4

A company's security policy requires that all Amazon EC2 instances must have a specific tag 'Environment' with a value of either 'Production' or 'Development'. The SysOps administrator needs to detect any instance that is missing this tag or has an invalid value, and automatically email the operations team. Which AWS service should be used to achieve this with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously monitors and evaluates the configuration of AWS resources against desired policies. By using an AWS Config managed rule such as `s3-bucket-server-side-encryption-enabled`, you can automatically detect any S3 bucket that lacks server-side encryption and trigger an SNS notification to the security team.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 5

A company wants to enforce that all Amazon EC2 instances launched in the AWS account must have a specific termination protection setting enabled. The SysOps administrator needs to automatically remediate any instances that are launched without termination protection. Which AWS service should be used to achieve this?

Accepted Answer

AWS Config with a custom rule using AWS Lambda to evaluate and enable termination protection.. AWS Config can evaluate resources against desired configurations using managed or custom rules. A custom AWS Config rule can invoke a Lambda function to check if termination protection is enabled on EC2 instances and automatically enable it if missing, providing the required remediation. This approach directly addresses the requirement to enforce termination protection on all launched instances.

Answer

AWS Config with a managed rule ec2-instance-no-public-ip and an SSM Automation remediation.

Answer

Amazon Inspector to scan instances and trigger a remediation action.

Answer

AWS Systems Manager Patch Manager to apply a policy for termination protection.

Question 6

A company's security policy requires that only traffic from the corporate office IP range (203.0.113.0/24) can access an Amazon S3 bucket that stores internal reports. The SysOps administrator must enforce this restriction. Which policy type should be modified to implement this requirement?

Accepted Answer

S3 bucket policy. An S3 bucket policy is the correct choice because it allows you to explicitly deny or allow access to the S3 bucket based on the source IP address using the `aws:SourceIp` condition key. This policy is attached directly to the bucket and can restrict access to only the corporate office IP range (203.0.113.0/24), regardless of the IAM user or role making the request. It enforces the security requirement at the resource level, which is the most direct and effective method for controlling network-based access to an S3 bucket.

Answer

IAM identity-based policy

Answer

VPC endpoint policy

Answer

AWS Organizations SCP

Question 7

A company requires that all Amazon EC2 instances launched in its AWS account must have termination protection enabled. The SysOps administrator needs to automatically remediate any instance launched without termination protection. The solution should use AWS managed services without custom scripts. Which AWS service should be used?

Accepted Answer

Configure AWS Config with a managed rule 'ec2-termination-protection-check' and set an auto-remediation action using an AWS Systems Manager Automation document that enables termination protection on the instance.. AWS Config's managed rule 'ec2-termination-protection-check' can detect instances without termination protection, and you can attach an auto-remediation action using an AWS Systems Manager Automation document (e.g., AWS-EnableTerminationProtection) to automatically enable termination protection on noncompliant instances. This solution uses only AWS managed services and requires no custom scripts, meeting the company's requirements.

Answer

Use Amazon EC2 Auto Scaling to automatically apply termination protection to all launched instances.

Answer

Enable AWS Trusted Advisor to send notifications when instances lack termination protection, and have administrators manually fix them.

Answer

Create an IAM policy that denies the RunInstances action unless termination protection is enabled.

Question 8

A SysOps administrator needs to ensure that all Amazon S3 buckets in an AWS account are configured with server-side encryption using AWS KMS (SSE-KMS). The administrator wants to automatically detect any S3 buckets that are not compliant and remediate them by enabling SSE-KMS. Which AWS service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled) that can continuously evaluate S3 buckets for compliance with SSE-KMS. When a non-compliant bucket is detected, AWS Config can trigger an AWS Systems Manager Automation document or a custom remediation action (via AWS Config Rules remediation) to automatically enable SSE-KMS on the bucket, ensuring automated enforcement without manual intervention.

Answer

AWS Trusted Advisor

Answer

AWS Service Catalog

Answer

AWS CloudFormation

Question 9

A company's security policy requires that all Amazon EC2 instances must have a specific tag 'Environment' with a value of either 'Production' or 'Development'. The SysOps administrator needs to detect any instance that is missing this tag or has an invalid value, and automatically email the operations team. Which AWS service should be used to achieve this with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key allows the administrator to enforce MFA authentication by checking whether the user authenticated with a valid MFA device before allowing the action. When set to `true`, the policy denies access to EC2 actions unless the user has completed MFA. This directly satisfies the security policy requirement.

Answer

aws:SourceIp

Answer

iam:PassedToService

Answer

ec2:SourceInstanceARN

Question 10

A company's security policy requires that all Amazon EC2 instances must have a specific tag 'Environment' with a value of either 'Production' or 'Development'. The SysOps administrator needs to detect any instance that is missing this tag or has an invalid value, and automatically email the operations team. Which AWS service should be used to achieve this with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled) that can continuously evaluate S3 bucket configurations against the security policy. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-S3, enforcing compliance without manual intervention.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 11

A company manages multiple AWS accounts under AWS Organizations. The security team requires that all Amazon S3 buckets in the organization must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect any bucket that is not compliant and remediate it by enabling SSE-KMS. Which AWS feature or service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config with the s3-bucket-server-side-encryption-enabled managed rule and automatic remediation using an AWS Systems Manager Automation document.. AWS Config's `s3-bucket-server-side-encryption-enabled` managed rule can evaluate S3 buckets for encryption compliance. When a non-compliant bucket is detected, AWS Config can trigger automatic remediation via an AWS Systems Manager Automation document that applies SSE-KMS encryption to the bucket. This provides a fully automated, policy-driven enforcement mechanism without manual intervention.

Answer

AWS CloudTrail to log bucket creation events and trigger an AWS Lambda function that applies SSE-KMS.

Answer

Amazon Inspector to scan S3 buckets for encryption compliance and automatically apply SSE-KMS.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications but not auto-remediate.

Question 12

A company wants to restrict access to an AWS Systems Manager Parameter Store parameter to only requests originating from the corporate network IP range (10.0.0.0/8). The SysOps administrator needs to implement this restriction using an IAM policy. Which condition key should be used?

Accepted Answer

aws:SourceIp. The `aws:SourceIp` condition key is designed to restrict access based on the requester's IP address. In this scenario, the corporate network IP range is 10.0.0.0/8, which is a private IPv4 address range. When used in an IAM policy, `aws:SourceIp` evaluates the source IP of the request as seen by AWS, allowing you to permit or deny access to Systems Manager Parameter Store based on that IP range.

Answer

aws:SourceVpc

Answer

aws:RequestedRegion

Answer

aws:UserAgent

Question 13

A company's security team requires that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. The SysOps administrator needs to create an IAM policy that denies all console actions if the user has not authenticated with MFA. Which IAM condition key should the administrator use?

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key evaluates to `true` when the user has authenticated using MFA. By using this key in a `Deny` statement, the policy can block all console actions unless MFA is present, enforcing the security team's requirement.

Answer

aws:SourceIp

Answer

iam:PassedToService

Answer

aws:RequestedRegion

Question 14

Match each AWS service with its primary security compliance function. (Drag each service to its correct function.) (Choose 4.)

Accepted Answer

AWS CloudTrail -> Detect unauthorized API calls. AWS CloudTrail is the service that records API activity in your AWS account, including both management and data events. By enabling CloudTrail, you can detect unauthorized API calls by analyzing the recorded events for actions that were not initiated by authorized users or services, such as an IAM user making a call from an unexpected IP address or using an unknown user agent.

Question 15

A company's security policy requires that all Amazon EC2 instances must have a specific tag 'Environment' with a value of either 'Production' or 'Development'. The SysOps administrator needs to detect any instance that is missing this tag or has an invalid value, and automatically email the operations team. Which AWS service should be used to achieve this with the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config with a managed rule and AWS Lambda for automatic remediation.. AWS Config with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) can continuously evaluate S3 buckets for compliance with the encryption policy. When a non-compliant bucket is detected, AWS Config can automatically invoke an AWS Lambda function to remediate the issue, such as enabling encryption with a customer managed KMS key. This combination provides automated detection and remediation using infrastructure as code, as the Config rule and Lambda function can be defined in AWS CloudFormation or similar IaC tools.

Answer

AWS CloudTrail and Amazon GuardDuty.

Answer

Amazon Inspector and AWS Systems Manager.

Answer

Amazon Macie and AWS CloudFormation.