SOA-C02 Security and Compliance Practice Test 3 — 15 Questions

Question 1

A company's security policy requires that all IAM users must change their passwords every 90 days. The SysOps administrator needs to enforce this requirement. Which IAM setting should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IAM password policy. The IAM password policy is the correct setting because it allows the SysOps administrator to define password rotation requirements, such as a mandatory password change every 90 days. This policy is applied at the account level and enforces the security requirement for all IAM users, ensuring compliance without needing to modify individual user permissions.

Answer

IAM user permissions boundary

Answer

IAM role trust policy

Answer

IAM group policy

Question 2

A company's security policy requires that all IAM users must change their passwords every 90 days. The SysOps administrator needs to enforce this requirement. Which IAM setting should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key evaluates to `true` when the requesting IAM user has authenticated using a valid MFA device. By including this key in a `Deny` statement with a condition that it is `false`, the policy effectively blocks any S3 access unless MFA was used. This directly enforces the security policy requirement.

Answer

aws:UserAgent

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Question 3

A company wants to ensure that all Amazon S3 buckets have versioning enabled to protect against accidental deletion of objects. A SysOps administrator needs to automatically detect any buckets that do not have versioning enabled and receive notifications. Which AWS service should the administrator use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules, such as 's3-bucket-versioning-enabled', that continuously evaluate your S3 buckets against desired configuration states. When a bucket is non-compliant (versioning disabled), AWS Config can trigger an Amazon SNS notification to alert the administrator, enabling automated detection and remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 4

A company stores database credentials in AWS Secrets Manager. The security policy requires that the credentials be rotated automatically every 30 days. Which action should the SysOps administrator take to enforce this requirement?

Accepted Answer

Enable automatic rotation in the Secrets Manager console and specify a rotation interval of 30 days using a Lambda rotation function.. AWS Secrets Manager natively supports automatic rotation using a Lambda function. By enabling automatic rotation in the console and specifying a 30-day interval, the administrator meets the security policy without manual intervention. Secrets Manager handles the rotation schedule and invokes the Lambda function automatically.

Answer

Configure an AWS Lambda function to rotate the secret and set a CloudWatch Events rule to trigger it every 30 days.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and configure a State Manager association for rotation.

Answer

Create an IAM policy that forces users to rotate the secret manually every 30 days.

Question 5

A company uses AWS Organizations to manage multiple AWS accounts. The security team requires that all Amazon S3 buckets in every account be encrypted at rest using AWS KMS customer managed keys. The SysOps administrator needs to enforce this requirement centrally without requiring changes in each account individually. Which approach should the administrator use?

Accepted Answer

Create a service control policy (SCP) in the management account that denies creation of S3 buckets without KMS encryption. A service control policy (SCP) applied at the AWS Organizations management account can centrally deny the creation of S3 buckets that do not have AWS KMS encryption enabled, affecting all member accounts without requiring individual account changes. SCPs act as a permission guardrail that restricts what actions accounts can perform, even for account administrators, making them ideal for enforcing organization-wide security policies like mandatory KMS encryption on S3 bucket creation.

Answer

Create an IAM policy in each account that denies creation of unencrypted S3 buckets

Answer

Configure an S3 bucket policy on each bucket to require encryption

Answer

Enable AWS Config rules in each account to detect and remediate non-compliant buckets

Question 6

A company requires all S3 uploads to use server-side encryption with a specific customer managed KMS key. What is the most direct enforcement mechanism?

Accepted Answer

Add a bucket policy that denies PutObject unless the required SSE-KMS headers and key ID are present.. A bucket policy with a condition that denies `s3:PutObject` unless the required `x-amz-server-side-encryption` header is set to `aws:kms` and the `x-amz-server-side-encryption-aws-kms-key-id` header matches the specific customer managed KMS key ARN is the most direct enforcement mechanism. This policy-based approach ensures that any upload attempt lacking the required SSE-KMS headers and key ID is rejected at the S3 API level, regardless of the IAM permissions of the uploader.

Answer

Enable S3 versioning only.

Answer

Enable S3 Transfer Acceleration.

Answer

Create an IAM user for every uploader with console access.

Question 7

Match each AWS compute service to its use case.

Accepted Answer

Amazon EC2: Full control over virtual servers including OS and software.. Amazon EC2 gives full server control; AWS Lambda runs serverless code; Amazon ECS manages containers. Distractors swap definitions with Lambda or Elastic Beanstalk.

Answer

Amazon EC2: Run code without provisioning or managing servers.

Answer

AWS Lambda: Managed container orchestration service.

Answer

Amazon ECS: Deploy web applications without managing infrastructure.

Question 8

Match each AWS cost management tool to its purpose.

Accepted Answer

AWS Cost Explorer: Visualize, understand, and manage AWS costs and usage over time.. The correct matches: AWS Cost Explorer visualizes costs, AWS Budgets sets alerts, AWS Cost and Usage Report provides detailed data, and AWS Trusted Advisor offers cost optimization recommendations. Common confusions include swapping the purposes of Cost Explorer and Budgets, or Budgets with the Cost and Usage Report.

Answer

AWS Cost Explorer: Set custom budgets to track cost and usage and get alerts.

Answer

AWS Budgets: Detailed data about AWS costs and usage in a CSV or Parquet file.

Question 9

A company wants to enforce that all Amazon S3 buckets in their AWS account are encrypted at rest. They have enabled AWS CloudTrail and want to automatically remediate any non-compliant bucket created by users. Which AWS service should they use to achieve this?

Accepted Answer

AWS Config. AWS Config can evaluate resource configurations against rules and trigger automated remediation using AWS Config Rules with Systems Manager Automation or Lambda, enabling automatic enforcement of S3 bucket encryption. Option A is wrong because AWS Trusted Advisor provides best-practice checks and can identify non-compliant resources but does not automate remediation. Option B is wrong because Amazon Inspector is for vulnerability assessment and network security, not for S3 bucket encryption enforcement. Option D is wrong because AWS Service Catalog is used for creating and managing approved IT services and portfolios, not for monitoring or remediation.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Service Catalog

Question 10

A SysOps administrator needs to ensure that an Amazon EC2 instance can access an Amazon S3 bucket without storing long-term credentials on the instance. Which approach should be used?

Accepted Answer

Create an IAM role with S3 permissions and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance profile allows the instance to obtain temporary security credentials from the instance metadata service, eliminating the need to store long-term credentials on the instance. Option A is incorrect because security groups control network traffic, not API-level access to S3. Option B is incorrect because a bucket policy granting access based on a public IP address is insecure and does not provide AWS credentials. Option D is incorrect because storing IAM user credentials on the instance is insecure and not a best practice.

Answer

Configure a security group rule that allows outbound traffic to S3.

Answer

Assign a bucket policy that grants access to the EC2 instance's public IP address.

Answer

Create an IAM user with programmatic access and store the credentials in a file on the instance.

Question 11

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create access keys for themselves. Which is the MOST effective way to enforce this policy across all accounts?

Accepted Answer

Attach a service control policy to the root organizational unit that denies 'iam:CreateAccessKey'.. A service control policy (SCP) attached to the root organizational unit applies to all accounts in the AWS organization, effectively denying the 'iam:CreateAccessKey' action for all IAM users and roles, including the root user (though root user actions cannot be denied by SCPs, but IAM users can be controlled). Option A is incorrect because an IAM permissions boundary limits the maximum permissions a user can have but does not deny specific actions; it also does not prevent root user actions. Option C is incorrect because an S3 bucket policy controls access to S3 resources, not IAM actions. Option D is incorrect because an IAM group policy only applies to users in that group, and users could be added outside the group or in other accounts, making it ineffective for cross-account enforcement.

Answer

Set an IAM permissions boundary on all users that denies 'iam:CreateAccessKey'.

Answer

Create an S3 bucket policy that denies access to IAM users with access keys.

Answer

Create an IAM group with a policy that denies 'iam:CreateAccessKey' and add all users to that group.

Question 12

An application running on Amazon EC2 needs to encrypt data before writing to Amazon S3. The encryption key must be rotated every 90 days and access to the key must be auditable. Which solution meets these requirements?

Accepted Answer

Use client-side encryption with a master key stored on the EC2 instance.. It allows client-side encryption, which encrypts data before writing to S3. The master key stored on the EC2 instance can be manually rotated every 90 days, meeting the rotation requirement. Auditability can be achieved by monitoring access to the EC2 instance and the key file using AWS CloudTrail and other logging services. Option A is incorrect because AWS KMS automatic rotation rotates CMKs annually, not every 90 days, so it does not meet the requirement. Option C only encrypts data in transit, not at rest. Option D provides server-side encryption with S3-managed keys, which do not support customer-controlled rotation or key usage auditing.

Answer

Use AWS KMS customer master key (CMK) with automatic rotation enabled and client-side encryption.

Answer

Use SSL/TLS to encrypt data in transit from EC2 to S3.

Answer

Use Amazon S3 server-side encryption with SSE-S3.

Question 13

A SysOps administrator needs to restrict access to an Amazon S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy statement should be added to the bucket policy?

Accepted Answer

Condition: { StringEquals: { 'aws:SourceVpce': 'vpce-12345' } }. The condition key 'aws:SourceVpce' is used to restrict access to requests originating from a specific VPC endpoint (identified by its endpoint ID). Option A uses 'aws:SourceVpc', which restricts to an entire VPC, not a specific endpoint. Option B uses 'ec2:Vpc', which is not a valid condition key for S3 bucket policies. Option C uses 'aws:VpcSourceIp', which is not a valid condition key; the correct key for IP-based restrictions is 'aws:SourceIp'.

Answer

Condition: { StringEquals: { 'aws:SourceVpc': 'vpc-12345' } }

Answer

Condition: { StringEquals: { 'ec2:Vpc': 'vpc-12345' } }

Answer

Condition: { IpAddress: { 'aws:VpcSourceIp': '10.0.0.0/16' } }

Question 14

A company requires that all AWS account activity be recorded and the logs be stored in a centralized S3 bucket for analysis. Which two AWS services should be used together to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon S3. (AWS CloudTrail and Amazon S3) is correct because AWS CloudTrail records API activity in an AWS account and can deliver log files to a specified S3 bucket for centralized storage and analysis. Option A (Amazon GuardDuty and Amazon S3) is incorrect because GuardDuty is a threat detection service that monitors for malicious activity, but it does not record all API activity. Option C (AWS Config and Amazon S3) is incorrect because AWS Config evaluates resource configurations and tracks changes, not API activity. Option D (Amazon Inspector and Amazon S3) is incorrect because Inspector is a vulnerability assessment service for EC2 instances. Option E (VPC Flow Logs and Amazon S3) is incorrect because VPC Flow Logs capture IP traffic information for network interfaces, not API calls.

Answer

Amazon GuardDuty and Amazon S3

Answer

AWS Config and Amazon S3

Answer

Amazon Inspector and Amazon S3

Answer

VPC Flow Logs and Amazon S3

Question 15

A SysOps administrator is troubleshooting an issue where an IAM user is unable to launch an EC2 instance in a specific subnet. The user has the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:Subnet": "subnet-12345"
        }
      }
    }
  ]
}

What is the likely cause of the failure?

Accepted Answer

The user is not specifying the subnet ID when launching the instance.. The 'ec2:Subnet' condition key requires the user to specify the subnet ID in the RunInstances call. If the user does not specify a subnet (e.g., using the default VPC), the condition fails. Option A is wrong because the policy allows RunInstances, not just Describe. Option C is wrong because the condition is explicitly for subnet-12345, so it does not deny all subnets. Option D is wrong because the condition key 'ec2:Subnet' is valid for RunInstances.

Answer

The policy does not allow the 'ec2:DescribeSubnets' action, so the user cannot list subnets.

Answer

The policy denies all subnets except subnet-12345.

Answer

The condition key 'ec2:Subnet' is not supported for RunInstances.