SOA-C02 Security and Compliance Practice Test 4 — 15 Questions

Question 1

A company wants to ensure that all data in Amazon S3 is encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be used to deny any PUT request that does not include the 'x-amz-server-side-encryption' header with value 'aws:kms'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Condition: { StringNotEquals: { 's3:x-amz-server-side-encryption': 'aws:kms' } }. It uses the condition key 's3:x-amz-server-side-encryption' and denies the request when the header value is not 'aws:kms', enforcing SSE-KMS. Option B is incorrect because it checks the specific KMS key ID via 's3:x-amz-server-side-encryption-aws-kms-key-id', not the encryption type. Option C is incorrect because 's3:ServerSideEncryption' is not a valid condition key for S3; the correct key is 's3:x-amz-server-side-encryption'. Option D is incorrect because using StringEquals with this condition key would only match requests that include the header with value 'aws:kms', but a deny policy with this condition would not block requests that omit the header entirely; additionally, the question requires denying requests that do not include the specified encryption header.

Answer

Condition: { StringNotEquals: { 's3:x-amz-server-side-encryption-aws-kms-key-id': 'alias/aws/s3' } }

Answer

Condition: { StringNotEquals: { 's3:ServerSideEncryption': 'KMS' } }

Answer

Condition: { StringEquals: { 's3:x-amz-server-side-encryption': 'aws:kms' } }

Question 2

A company is designing a secure application architecture. They need to ensure that sensitive data stored in Amazon S3 is not accessible from the public internet. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Use an S3 VPC Gateway Endpoint to restrict access to the VPC.. Options A and E are correct. Using an S3 VPC Gateway Endpoint ensures that access to the bucket is restricted to resources within the specified VPC, effectively blocking public internet traffic. Blocking all public access at the bucket level explicitly denies any public access, preventing the bucket from being accessible over the internet. Option B (default encryption) protects data at rest but does not control access; the bucket can still be public. Option C (MFA Delete) is for deletion protection, not access control. Option D (CloudFront with OAI) can provide secure access via CloudFront but does not inherently block direct public access to the S3 bucket if the bucket policy allows it.

Answer

Enable default encryption on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Use Amazon CloudFront with Origin Access Identity (OAI).

Question 3

A company uses AWS Organizations and wants to restrict the use of specific AWS services across all member accounts. Which TWO methods can be used to enforce these restrictions? (Choose TWO.)

Accepted Answer

Create IAM policies in each account that deny the service actions and attach them to all IAM users and roles.. IAM policies in each account can deny actions for specific services, and when attached to all IAM users and roles, they effectively restrict usage across the account, though this requires consistent application. Option D is correct because SCPs attached to the root organizational unit can deny access to specified services across all member accounts in the organization. Option B is incorrect because AWS Config rules can detect non-compliance but cannot enforce restrictions or disable services. Option C is incorrect because AWS Service Catalog is used to create and manage a catalog of approved services, not to block disallowed services. Option E is incorrect because VPC endpoints control network traffic to services, not service-level restrictions.

Answer

Use AWS Config rules to automatically disable non-compliant services.

Answer

Use AWS Service Catalog to block the use of disallowed services.

Answer

Configure VPC endpoints to block traffic to the disallowed services.

Question 4

A company has the following S3 bucket policy attached to a bucket named 'example-bucket'. A user is unable to download an object from the bucket using an HTTP URL (not HTTPS). What is the cause?

Accepted Answer

The Deny statement blocks all S3 actions when the request is not using HTTPS.. The bucket policy contains a Deny statement that applies to all s3:* actions when the request does not use HTTPS (SecureTransport is false). Even though there is an Allow statement for GetObject to everyone, the explicit Deny overrides the Allow. Option A is incorrect because the issue is not about anonymous users; the Deny affects all requests. Option C is incorrect because the policy does not mention server-side encryption. Option D is incorrect because the Deny statement applies to all S3 actions, not just PutObject.

Answer

The bucket policy does not allow GetObject for anonymous users.

Answer

The bucket policy requires server-side encryption for all requests.

Answer

The Deny statement only applies to PutObject, not GetObject.

Question 5

A SysOps administrator is investigating a security incident where an unauthorized key pair was created. The CloudTrail lookup command output is shown. The administrator wants to find the source IP address of the 'admin' user who created the key pair. Which field in the 'CloudTrailEvent' JSON should the administrator examine?

Accepted Answer

sourceIPAddress. The source IP address of the API call is recorded in the 'sourceIPAddress' field within the CloudTrail event JSON. Therefore, option C is correct. Option A (requestParameters) contains the parameters of the request, not the IP. Option B (userIdentity) contains information about the user identity, not the IP. Option D (eventTime) is the timestamp.

Answer

requestParameters

Answer

userIdentity

Answer

eventTime

Question 6

A SysOps administrator is tasked with encrypting data at rest for an Amazon S3 bucket that stores sensitive customer information. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption solution meets these requirements?

Accepted Answer

Use server-side encryption with Amazon S3-managed keys (SSE-S3).. SSE-S3 uses Amazon S3-managed keys that are automatically rotated by AWS, meeting the requirement for AWS-managed and automatic rotation. Option A is wrong because client-side encryption is not managed by AWS and does not use server-side encryption. Option B is wrong because SSE-C requires the customer to provide their own encryption keys, which are not automatically rotated. Option D is wrong because SSE-KMS uses AWS KMS keys that are customer-managed unless automatic rotation is specifically enabled, and the question requires automatic rotation without additional configuration.

Answer

Use client-side encryption with AWS KMS.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use server-side encryption with AWS KMS (SSE-KMS).

Question 7

A company wants to allow a developer to deploy applications using AWS CloudFormation but restrict the developer from creating or modifying IAM resources. Which IAM policy should be used?

Accepted Answer

Allow cloudformation:* and deny iam:*. It grants full access to CloudFormation (cloudformation:*) while explicitly denying all IAM actions (iam:*). This ensures the developer can deploy applications using CloudFormation but cannot create or modify IAM resources. Option A is wrong because it allows all IAM actions, which would permit creating and modifying IAM resources. Option B is wrong because it denies all CloudFormation actions, preventing deployment. Option D is wrong because it only allows CloudFormation actions without explicitly denying IAM actions, leaving open the possibility that other policies could grant IAM access.

Answer

Allow iam:*

Answer

Deny cloudformation:*

Answer

Allow cloudformation:* only

Question 8

Which TWO actions should a SysOps administrator take to secure an S3 bucket that stores sensitive data? (Choose two.)

Accepted Answer

Enable S3 Block Public Access settings on the bucket.. Options A and D are correct. Enabling S3 Block Public Access (A) prevents public access to the bucket, which is essential for securing sensitive data. Enabling S3 server access logging (D) provides detailed audit logs of requests, helping detect unauthorized access. Option B is incorrect because CORS is for cross-origin requests, not security. Option C is incorrect because versioning helps with data protection and recovery, but does not directly control access. Option E is incorrect because Transfer Acceleration is for faster uploads, not security.

Answer

Enable cross-origin resource sharing (CORS) on the bucket.

Answer

Enable S3 Versioning.

Answer

Enable S3 Transfer Acceleration.

Question 9

A company wants to audit all API calls made in their AWS account for compliance. Which THREE AWS services can be used together to capture and store these logs? (Choose three.)

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (B) captures all API calls made in the account. Amazon S3 (D) provides durable, cost-effective storage for the log files. Amazon CloudWatch Logs (A) can be used to monitor the logs, set alarms, and trigger actions based on specific API calls. AWS Config (C) tracks resource configuration changes, not API calls, and Amazon GuardDuty (E) is a threat detection service, not designed for storing audit logs. Therefore, the correct combination is A, B, D.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 10

Which TWO measures help protect an AWS account root user? (Choose two.)

Accepted Answer

Use a strong, complex password for the root user.. Options D and E are correct. Using a strong, complex password and enabling MFA for the root user are essential security measures to protect the account. Option A is incorrect because using the root user regularly increases the risk of compromise; it should be used only for tasks that require root privileges. Option B is incorrect because creating an access key for the root user exposes long-term credentials that can be misused; root user access keys should be avoided. Option C is incorrect because granting other IAM users full administrator access does not directly protect the root user; it reduces dependency on the root user but is not a security measure for the root user itself.

Answer

Use the root user regularly for administrative tasks.

Answer

Create an access key for the root user for programmatic access.

Answer

Grant other IAM users full administrator access.

Question 11

Refer to the exhibit. An IAM policy is attached to a user. The user's IP address is 10.0.1.5. What is the result when the user tries to download an object from the folder 'confidential' in 'example-bucket'?

Accepted Answer

The request is denied because of the explicit Deny statement.. The policy contains an explicit Deny for the 'confidential' folder. In IAM, an explicit Deny overrides any Allow. Therefore, even if the user's IP is within the allowed range, the Deny blocks the download. Options B, C, and D are incorrect because the Deny is unconditional and does not depend on IP address.

Answer

The request is allowed because the Deny statement only applies if the IP is outside the range.

Answer

The request is allowed because the user's IP matches the allowed range.

Answer

The request is denied because the Deny statement applies only when the IP is outside the range.

Question 12

Refer to the exhibit. A company has a CloudTrail trail in us-east-1 that logs events for that region only. The company operates in multiple regions and wants to ensure all API calls from all regions are logged. What is the most efficient way to achieve this?

Accepted Answer

Update the existing trail to be a multi-region trail.. Updating the existing trail to be a multi-region trail is the most efficient way to log events from all regions. A multi-region trail logs API calls from all AWS regions into a single trail, aggregating them in the same S3 bucket. Option A is incorrect because CloudWatch Events can capture API calls, but it is less efficient and more complex than using a multi-region trail. Option B is incorrect because S3 event notifications are triggered by S3 events, not API calls, and cannot capture all API calls. Option C is incorrect because creating a new trail in each region results in multiple trails and log files, which is less efficient to manage than a single multi-region trail.

Answer

Use Amazon CloudWatch Events to capture API calls from all regions.

Answer

Use S3 event notifications to trigger a Lambda function that logs API calls.

Answer

Create a new CloudTrail trail in each region.

Question 13

Refer to the exhibit. An IAM policy allows a user to run instances only of type t2.micro. What happens when the user tries to run a t2.small instance?

Accepted Answer

The request is denied because t2.small does not match the condition.. The policy includes a condition that restricts the allowed instance type to t2.micro. When the user attempts to run a t2.small instance, it does not satisfy the condition, so the request is implicitly denied. Option A is incorrect because the policy does not allow all instance types; it only allows t2.micro. Option B is incorrect because there is no explicit deny statement; the deny is implicit due to the condition not being met. Option C is incorrect because the condition specifically evaluates the instance type parameter, not just the resource ARN.

Answer

The request is allowed because the policy allows ec2:RunInstances.

Answer

The request is denied because there is an explicit deny on ec2:RunInstances.

Answer

The request is allowed because the condition only applies to the resource ARN, not the instance type.

Question 14

A company's security team wants to ensure that all new S3 buckets created in the AWS account are automatically encrypted with server-side encryption. What should a SysOps administrator do to enforce this?

Accepted Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to encrypt the bucket.. A service control policy (SCP) cannot deny the creation of unencrypted S3 buckets because the s3:CreateBucket API does not accept an encryption setting or expose a condition key for encryption. The correct approach is to use AWS CloudTrail to monitor CreateBucket events and trigger a Lambda function that enables default encryption on newly created buckets. Option A is wrong because Block Public Access only controls public access, not encryption. Option C is wrong because existing bucket settings do not apply to new buckets.

Answer

Enable S3 Block Public Access at the account level.

Answer

Enable default encryption on each existing bucket.

Answer

Use a service control policy (SCP) to deny creation of buckets without encryption.

Question 15

An organization requires that all data in transit between EC2 instances and the internet be encrypted. Which AWS service can be used to enforce this requirement?

Accepted Answer

Use an Application Load Balancer (ALB) with a TLS listener.. An Application Load Balancer (ALB) with a TLS listener can terminate TLS and enforce encrypted connections between clients and the ALB. Option A is incorrect because network ACLs are stateless and do not provide encryption; they only filter traffic at the subnet level. Option C is incorrect because security groups are stateful and can filter traffic based on rules, but they do not encrypt traffic. Option D is incorrect because AWS Direct Connect provides a dedicated private connection but does not inherently encrypt the traffic; encryption must be configured separately.

Answer

Use a network ACL to allow only port 443.

Answer

Use a security group to allow only TLS traffic.

Answer

Use AWS Direct Connect to route all traffic.