SOA-C02 Security and Compliance Practice Test 4 — 15 Questions

Question 1

A company wants to ensure that all Amazon S3 buckets have versioning enabled to protect against accidental deletion of objects. A SysOps administrator needs to automatically detect any buckets that do not have versioning enabled and receive notifications. Which AWS service should the administrator use?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules, such as 's3-bucket-versioning-enabled', that continuously evaluate your S3 buckets against desired configuration states. When a bucket is non-compliant (versioning disabled), AWS Config can trigger an Amazon SNS notification to alert the administrator, enabling automated detection and remediation.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 2

A company stores database credentials in AWS Secrets Manager. The security policy requires that the credentials be rotated automatically every 30 days. Which action should the SysOps administrator take to enforce this requirement?

Accepted Answer

Enable automatic rotation in the Secrets Manager console and specify a rotation interval of 30 days using a Lambda rotation function.. Option B is correct because AWS Secrets Manager natively supports automatic rotation using a Lambda function. By enabling automatic rotation in the console and specifying a 30-day interval, the administrator meets the security policy without manual intervention. Secrets Manager handles the rotation schedule and invokes the Lambda function automatically.

Answer

Configure an AWS Lambda function to rotate the secret and set a CloudWatch Events rule to trigger it every 30 days.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and configure a State Manager association for rotation.

Answer

Create an IAM policy that forces users to rotate the secret manually every 30 days.

Question 3

A company uses AWS Organizations to manage multiple AWS accounts. The security team requires that all Amazon S3 buckets in every account be encrypted at rest using AWS KMS customer managed keys. The SysOps administrator needs to enforce this requirement centrally without requiring changes in each account individually. Which approach should the administrator use?

Accepted Answer

Create a service control policy (SCP) in the management account that denies creation of S3 buckets without KMS encryption. Option C is correct because a service control policy (SCP) applied at the AWS Organizations management account can centrally deny the creation of S3 buckets that do not have AWS KMS encryption enabled, affecting all member accounts without requiring individual account changes. SCPs act as a permission guardrail that restricts what actions accounts can perform, even for account administrators, making them ideal for enforcing organization-wide security policies like mandatory KMS encryption on S3 bucket creation.

Answer

Create an IAM policy in each account that denies creation of unencrypted S3 buckets

Answer

Configure an S3 bucket policy on each bucket to require encryption

Answer

Enable AWS Config rules in each account to detect and remediate non-compliant buckets

Question 4

A company requires all S3 uploads to use server-side encryption with a specific customer managed KMS key. What is the most direct enforcement mechanism?

Accepted Answer

Add a bucket policy that denies PutObject unless the required SSE-KMS headers and key ID are present.. Option A is correct because a bucket policy with a condition that denies `s3:PutObject` unless the required `x-amz-server-side-encryption` header is set to `aws:kms` and the `x-amz-server-side-encryption-aws-kms-key-id` header matches the specific customer managed KMS key ARN is the most direct enforcement mechanism. This policy-based approach ensures that any upload attempt lacking the required SSE-KMS headers and key ID is rejected at the S3 API level, regardless of the IAM permissions of the uploader.

Answer

Enable S3 versioning only.

Answer

Enable S3 Transfer Acceleration.

Answer

Create an IAM user for every uploader with console access.

Question 5

Developers are allowed to create IAM roles for their Lambda functions. However, the security team is concerned that developers could create roles with Administrator access, granting Lambda functions more permissions than the developers themselves have. What IAM feature prevents privilege escalation in this scenario?

Accepted Answer

Attach a permission boundary to each developer IAM user that limits them to creating roles with only the permissions they are allowed to grant. Permission boundaries are an IAM feature that allow you to set the maximum permissions that an identity-based policy can grant to a principal. By attaching a permission boundary to each developer IAM user that restricts them to creating roles with only the permissions they are allowed to grant, you prevent the developer from creating a Lambda execution role with AdministratorAccess or any other policy that exceeds the boundary. This directly addresses the privilege escalation concern because the boundary acts as a ceiling on the permissions the developer can delegate to the role.

Answer

Enable IAM Access Analyzer to detect when developers create overly permissive roles

Answer

Require MFA for all IAM API calls so developers must re-authenticate before creating roles

Answer

Enable CloudTrail logging for all IAM API calls and set up a CloudWatch alarm for iam:CreateRole events

Question 6

The CISO asks for a centralized dashboard showing security findings from GuardDuty, Macie, Inspector, and Firewall Manager across 30 AWS accounts. Findings must be normalized into a single format so they can be prioritized by severity without switching between services. Which AWS service provides this capability?

Accepted Answer

Enable AWS Security Hub with an administrator account in the organization; integrate GuardDuty, Macie, Inspector, and Firewall Manager as finding providers. AWS Security Hub is designed to aggregate, normalize, and prioritize security findings from multiple AWS services (GuardDuty, Macie, Inspector, Firewall Manager) and third-party tools across accounts. By designating an administrator account in AWS Organizations, you can centrally view all findings in a single dashboard, with a standardized findings format (AWS Security Finding Format, ASFF) that includes severity, resource, and remediation fields. This directly meets the CISO's requirement for a centralized, normalized, severity-prioritized view without switching between services.

Answer

Deploy a custom Lambda function that polls each service's API and writes findings to a DynamoDB table for a custom dashboard

Answer

Enable Amazon Detective to investigate and correlate security findings across all accounts

Answer

Configure AWS Config conformance packs to evaluate security compliance checks across all accounts and report to an aggregator account

Question 7

Account A owns an S3 bucket containing shared artifacts. Account B needs to read objects from the bucket. The Account A team wants to grant access without creating IAM users, sharing access keys, or creating a role in Account A that Account B assumes. How should the bucket be configured to allow Account B's IAM roles to read objects?

Accepted Answer

Add an S3 bucket policy on Account A's bucket with Principal set to Account B's account ID and s3:GetObject permission; ensure Account B's roles have s3:GetObject in their identity policies. Option A is correct because it uses an S3 bucket policy with a Principal set to Account B's account ID, which grants cross-account access to all IAM principals (users and roles) in Account B. Account B's IAM roles must also have an identity policy that allows s3:GetObject, ensuring that the effective permissions require both the bucket policy and the role's policy to allow the action. This approach avoids creating IAM users, sharing access keys, or setting up a role in Account A for Account B to assume.

Answer

Create an IAM role in Account A with s3:GetObject permission and a trust policy allowing Account B's roles to assume it

Answer

Generate a presigned URL for each object in Account A and share the URLs with Account B's services

Answer

Enable S3 Access Points on the bucket and create an access point that allows Account B's VPC to connect via PrivateLink

Question 8

An application stores its RDS PostgreSQL credentials in AWS Secrets Manager. The security policy requires credentials to be rotated every 30 days automatically. During rotation, the application must continue to serve traffic with zero downtime. The application retrieves credentials by calling GetSecretValue at the start of each database connection. What must be configured to satisfy all requirements?

Accepted Answer

Enable automatic rotation in Secrets Manager with a 30-day schedule; use the AWS-provided Lambda rotation function for RDS PostgreSQL; ensure the application calls GetSecretValue per connection rather than caching credentials. Option A is correct because AWS Secrets Manager's automatic rotation, combined with the AWS-provided Lambda rotation function for RDS PostgreSQL, ensures credentials are rotated every 30 days without manual intervention. The application's practice of calling GetSecretValue at the start of each database connection guarantees it always retrieves the current secret, avoiding stale credentials and achieving zero downtime during rotation.

Answer

Rotate credentials manually every 30 days by updating the secret value in the console and restarting the application

Answer

Create an EventBridge scheduled rule every 30 days that triggers a Lambda to generate a new RDS password and update both the database and the secret

Answer

Store credentials in an environment variable on the application's EC2 instance and rotate by updating the environment variable and reloading the application

Question 9

Drag and drop the steps to create an Amazon CloudWatch alarm that sends an email notification when CPU utilization exceeds 90% into the correct order.

Question 10

Drag and drop the steps to configure an Amazon Route 53 failover routing policy into the correct order.

Question 11

Match each AWS compute service to its use case.

Question 12

Match each AWS cost management tool to its purpose.

Question 13

A company wants to enforce that all Amazon S3 buckets in their AWS account are encrypted at rest. They have enabled AWS CloudTrail and want to automatically remediate any non-compliant bucket created by users. Which AWS service should they use to achieve this?

Accepted Answer

AWS Config. Option C is correct because AWS Config can evaluate resource configurations against rules and trigger automated remediation using Systems Manager Automation or Lambda. Option A is wrong because AWS Service Catalog is used for creating and managing approved IT services, not for monitoring or remediation. Option B is wrong because AWS Trusted Advisor provides best-practice checks but does not automate remediation. Option D is wrong because Amazon Inspector is for vulnerability assessment, not S3 bucket encryption enforcement.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Service Catalog

Question 14

A SysOps administrator needs to ensure that an Amazon EC2 instance can access an Amazon S3 bucket without storing long-term credentials on the instance. Which approach should be used?

Accepted Answer

Create an IAM role with S3 permissions and attach it to the EC2 instance profile.. Option B is correct because an IAM role attached to an EC2 instance allows the instance to obtain temporary credentials from the instance metadata service. Option A is wrong because storing IAM user credentials on the instance is insecure and not a best practice. Option C is wrong because a bucket policy alone does not grant access to a specific EC2 instance without the instance having AWS credentials. Option D is wrong because security groups control network traffic, not API-level access to S3.

Answer

Configure a security group rule that allows outbound traffic to S3.

Answer

Assign a bucket policy that grants access to the EC2 instance's public IP address.

Answer

Create an IAM user with programmatic access and store the credentials in a file on the instance.

Question 15

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create access keys for themselves. Which is the MOST effective way to enforce this policy across all accounts?

Accepted Answer

Attach a service control policy to the root organizational unit that denies 'iam:CreateAccessKey'.. Option D is correct because a service control policy (SCP) can deny the IAM action 'iam:CreateAccessKey' for all users in all accounts. Option A is wrong because a bucket policy is for S3, not IAM actions. Option B is wrong because an IAM group policy only applies to users in that group, and users could be added outside the group. Option C is wrong because an IAM permissions boundary limits the maximum permissions a user can have but does not prevent the root user from creating access keys.

Answer

Set an IAM permissions boundary on all users that denies 'iam:CreateAccessKey'.

Answer

Create an S3 bucket policy that denies access to IAM users with access keys.

Answer

Create an IAM group with a policy that denies 'iam:CreateAccessKey' and add all users to that group.