SOA-C02 Security and Compliance Practice Test 3 — 15 Questions

Question 1

A company stores sensitive data in an S3 bucket. The security team requires that all objects uploaded to the bucket be encrypted at rest using an AWS KMS customer-managed key. Which S3 bucket policy statement should be added to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"},"Null":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"true"}}}. To enforce that all uploads use an AWS KMS customer-managed key, the bucket policy must deny PutObject when the encryption header is not 'aws:kms' AND when the KMS key ID header is null. The StringNotEquals condition blocks AES256 and unencrypted uploads, while the Null condition ensures a specific KMS key is supplied rather than just any KMS key. Together they enforce customer-managed key usage.

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"aws:kms"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"Null":{"s3:x-amz-server-side-encryption":"true"}}}

Answer

{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Question 2

A company wants to allow its DevOps team to launch EC2 instances using a specific AMI ID and only in a particular VPC. Which IAM policy should be used?

Accepted Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:Vpc":"vpc-12345678","ec2:ImageId":"ami-12345678"}}}. It uses an Allow effect with a Condition block that requires both ec2:Vpc and ec2:ImageId to equal the specified values. IAM evaluates the condition keys against the request context, so RunInstances is only permitted when the instance is launched into vpc-12345678 using ami-12345678. This precisely enforces the least-privilege requirement of restricting both the AMI and the VPC.

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:Vpc":"vpc-12345678"},"StringNotEquals":{"ec2:ImageId":"ami-12345678"}}}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:region::image/ami-12345678"}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:Vpc":"vpc-12345678"}}}

Question 3

A company wants to provide temporary access to an S3 bucket for a third-party vendor. The vendor needs to upload files for one hour. Which approach should be used?

Accepted Answer

Generate a presigned URL for the S3 bucket that expires in one hour.. A presigned URL provides temporary access to a specific S3 object or bucket, with an expiration time. Generating a presigned URL for one hour allows the vendor to upload files without needing AWS credentials, meeting the requirement securely.

Answer

Create an IAM role and allow the vendor to assume it using their AWS account.

Answer

Create an IAM user with programmatic access and share the credentials with the vendor.

Answer

Create an S3 bucket policy that allows the vendor's IP address for one hour.

Question 4

Which THREE steps are required to enable AWS CloudTrail log file integrity validation? (Choose three.)

Accepted Answer

Enable CloudTrail to log management events and data events for all resources.. Option A is correct because CloudTrail log file integrity validation only produces signed digest files when the trail is actively logging events (management events, and data events if selected), so the trail must be configured to capture events for validation to have content to hash and sign. Option B is correct because CloudTrail must be able to write the digest files (the hourly digest and the digest signature files) into the same S3 bucket that stores the log files, which requires the bucket policy to grant CloudTrail the necessary s3:PutObject permissions for those digest objects. Option D is correct because integrity validation is an explicit trail-level setting that must be turned on by creating a new trail with --enable-log-file-validation or updating an existing trail with the equivalent API/console option. Option C is not required because CloudTrail uses its own RSA private key to sign digest files, not a customer-managed KMS key, so no KMS key creation is needed. Option E is not required because delivering logs to CloudWatch Logs is an optional monitoring feature and is unrelated to generating or validating the digest/signature files used for integrity validation.

Answer

Create a customer-managed KMS key to encrypt the digest files.

Answer

Configure CloudTrail to deliver logs to CloudWatch Logs for real-time analysis.

Question 5

A SysOps administrator runs the AWS CLI command shown in the exhibit. What is the purpose of this command?

Accepted Answer

To retrieve details about the most recent console login events.. The AWS CLI command in the exhibit is `aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin --max-results 5` (or similar). This command queries CloudTrail's event history for ConsoleLogin events, returning details about the most recent console login events. It does not count logins, list all API calls, or disable logging.

Answer

To count the number of console logins in the last 5 minutes.

Answer

To retrieve a list of all API calls made by the user john.doe.

Answer

To disable CloudTrail logging for console login events.

Question 6

A CloudFormation template creates an S3 bucket with encryption and a bucket policy as shown in the exhibit. An administrator tries to upload an object using the AWS CLI without specifying any encryption. What will happen?

Accepted Answer

The upload fails because the bucket policy denies PutObject without the encryption header.. The bucket policy explicitly denies PutObject requests that do not include the `x-amz-server-side-encryption` header with value `AES256`. Even though the bucket has default encryption enabled, the policy's Deny statement takes precedence and blocks the upload because the AWS CLI did not send the required header. Default encryption only applies when no encryption parameters are specified, but it does not override an explicit deny in the bucket policy.

Answer

The upload succeeds because the bucket has default encryption enabled.

Answer

The upload fails because the bucket policy allows only objects with AES256 encryption, but the default encryption is sufficient.

Answer

The upload succeeds because the default encryption automatically adds the AES256 header.

Question 7

A company is using AWS KMS to encrypt data at rest in S3. The security team wants to ensure that encryption keys are automatically rotated annually. Which type of KMS key should be used?

Accepted Answer

Use an AWS managed key. AWS managed KMS keys (AWS managed keys) are automatically rotated every year (365 days) with no action required from the customer. This satisfies the security team's requirement for annual automatic key rotation without any manual intervention or additional configuration.

Answer

Use an asymmetric KMS key

Answer

Use a custom key store (CloudHSM)

Answer

Use a customer managed key with imported key material

Question 8

A company has an S3 bucket configured to log all access requests to another bucket. The security team notices that some delete requests are not being logged. What is the most likely cause?

Accepted Answer

The delete requests were made through AWS CloudTrail, which bypasses S3 access logging. S3 server access logs record all requests made to a bucket, including DELETE requests, regardless of whether they are made via the AWS Management Console, CLI, SDK, or CloudTrail. CloudTrail is a separate auditing service that logs API calls, but it does not bypass S3 access logging. The most likely cause of missing delete requests is that S3 server access log delivery is best-effort and can occasionally be incomplete or delayed, or the logging configuration may be misconfigured (e.g., missing permissions on the destination bucket). Among the given options, none is correct.

Answer

The bucket policy denies logging of delete requests

Answer

The bucket has MFA Delete enabled, and the logging configuration does not capture MFA delete requests

Answer

S3 server access logs do not capture DELETE requests

Question 9

A company wants to ensure that all S3 buckets are encrypted by default. Which AWS service can be used to automatically enforce encryption on newly created S3 buckets?

Accepted Answer

AWS Config with a managed rule and auto-remediation. AWS Config provides managed rules (such as 's3-bucket-server-side-encryption-enabled' or 's3-default-encryption-kms') that continuously evaluate bucket configuration, and auto-remediation can automatically apply the required encryption setting when a bucket is non-compliant. This enforces encryption by default on newly created buckets without manual intervention. Config's continuous evaluation and remediation loop is the standard AWS pattern for this requirement.

Answer

S3 bucket policies

Answer

IAM policies

Answer

AWS CloudTrail

Question 10

A company has an S3 bucket with versioning enabled. They want to ensure that objects are not permanently deleted by users. What configuration should be applied?

Accepted Answer

Enable MFA Delete on the bucket. With versioning enabled, a delete request creates a delete marker instead of actually deleting the object. However, users with the s3:DeleteObject permission can still permanently delete specific versions. To prevent permanent deletion, you can enable MFA Delete, which requires multi-factor authentication to change the versioning state or permanently delete versions. Option A is correct. Option B is wrong because a lifecycle policy can delete noncurrent versions after a period, but it does not prevent user-initiated permanent deletions. Option C is wrong because a bucket policy that denies s3:DeleteObject does not prevent users with delete permissions from creating delete markers; it only prevents the actual deletion of objects. Option D is wrong because S3 Object Lock in governance mode prevents deletion during a retention period, but it is not specifically for preventing all permanent deletions by users; it is for compliance and requires setting retention periods.

Answer

Configure a lifecycle policy to expire noncurrent versions

Answer

Enable S3 Object Lock in governance mode

Answer

Add a bucket policy that denies s3:DeleteObject

Question 11

Which TWO actions can be taken to secure an S3 bucket that contains sensitive data? (Choose two.)

Accepted Answer

Enable default encryption for the bucket. Blocking all public access at the account level (Option E) prevents any public access to all buckets in the account, ensuring sensitive data is not exposed. Enabling default encryption (Option C) ensures that all objects uploaded to the bucket are encrypted at rest, protecting data even if the bucket or objects are compromised. Option A is incorrect because versioning protects against accidental deletion or overwrite, but does not secure data. Option B is incorrect; while a bucket policy that allows only HTTPS enforces encryption in transit, it is not the most direct or comprehensive security measure for sensitive data. Option D is incorrect because AWS CloudTrail logs API activity but does not directly secure the bucket.

Answer

Enable versioning on the bucket

Answer

Add a bucket policy that allows only HTTPS requests

Answer

Enable AWS CloudTrail for the bucket

Question 12

Refer to the exhibit. An IAM user has this policy attached. What is the effect when the user attempts to get an object from my-bucket from an IP address in the range 198.51.100.0/24?

Accepted Answer

Denied because the Deny statement applies. IAM policies are evaluated with an explicit deny taking precedence over any allow. If the policy contains a Deny statement whose condition matches the request (e.g., source IP in 198.51.100.0/24), the request is denied regardless of any Allow statement. The exhibit's Deny with that IP condition therefore blocks the GetObject call.

Answer

Allowed because the Deny condition does not match

Answer

Denied because there is no explicit Allow for that IP range

Answer

Allowed because there is an Allow statement

Question 13

Which THREE AWS services can be used to centrally manage and audit user permissions across multiple AWS accounts in AWS Organizations? (Choose THREE.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it records API activity across all accounts in an AWS Organization when organization trails are enabled, providing the audit log of who did what and when for centralized auditing. AWS Organizations (D) is correct because it is the service that centrally manages multiple AWS accounts, including applying Service Control Policies (SCPs) that define permission guardrails across member accounts. AWS IAM Access Analyzer (E) is correct because it analyzes resource-based policies and IAM policies to identify resources shared with external entities, helping centrally audit permissions and access across accounts. AWS WAF (A) is incorrect because it is a web application firewall for filtering HTTP(S) traffic, not a permission management or auditing service. AWS Config (C) is incorrect because it evaluates resource configuration compliance and records configuration changes, not user permissions across accounts.

Answer

AWS WAF

Answer

AWS Config

Question 14

A company's security policy requires that all data stored in Amazon S3 must be encrypted at rest using keys managed by the company. Which encryption option should the SysOps administrator choose?

Accepted Answer

Server-Side Encryption with AWS KMS (SSE-KMS). Both options A (SSE-KMS) and C (SSE-C) meet the requirement because both allow the company to manage the encryption keys. With SSE-KMS, you can use a customer-managed customer master key (CMK) in AWS KMS, giving you control over key rotation and access. With SSE-C, you provide your own encryption key in each request, and S3 performs encryption and then discards the key. SSE-C is more cumbersome, so SSE-KMS with a customer-managed CMK is typically the preferred approach. Options B (SSE-S3) uses AWS-managed keys, and D (Client-Side Encryption) encrypts data before sending to S3, but the requirement is for server-side encryption with company-managed keys.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3)

Answer

Client-Side Encryption

Question 15

Which TWO AWS services can be used to encrypt data at rest in Amazon RDS? (Choose TWO.)

Accepted Answer

Amazon RDS encryption feature. Amazon RDS encryption feature (D) is correct because RDS natively supports encryption at rest for DB instances, automated backups, read replicas, and snapshots, using AES-256 and keys managed through AWS KMS. AWS Key Management Service (AWS KMS) (E) is correct because it is the service that creates, stores, and manages the customer master keys (CMKs) used by RDS to encrypt data at rest, including support for customer-managed keys and automatic key rotation. AWS Certificate Manager (A) is not correct because ACM provisions and manages SSL/TLS certificates for encrypting data in transit, not data at rest. AWS CloudHSM (B) is not correct in this context because RDS does not use CloudHSM directly for its at-rest encryption; CloudHSM provides dedicated hardware security modules for custom key storage and cryptographic operations. AWS Identity and Access Management (C) is not correct because IAM controls authentication and authorization to AWS resources, not the encryption of stored data.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)