SOA-C02 Security and Compliance Practice Test 4 — 15 Questions

Question 1

An organization has a requirement to prevent any IAM user from deleting an S3 bucket that contains critical data. The SysOps administrator needs to implement a preventive control that works even if the user has full administrative privileges. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a service control policy (SCP) that denies s3:DeleteBucket for the account.. A Service Control Policy (SCP) is an AWS Organizations policy that can restrict permissions for all IAM users and roles within an account, including the root user. SCPs act as a preventive guardrail that overrides any IAM or bucket policies, so even a user with full administrative privileges (e.g., AdministratorAccess) cannot perform the denied action. This ensures that s3:DeleteBucket is blocked at the account level, providing a robust preventive control that cannot be bypassed by the user's own permissions.

Answer

Attach an IAM policy to the user that explicitly denies s3:DeleteBucket.

Answer

Enable MFA Delete on the bucket.

Answer

Add a bucket policy that denies s3:DeleteBucket for the user.

Question 2

A company uses S3 to store sensitive data. To meet compliance requirements, all S3 buckets must be encrypted at rest. The security team notices that some objects in a bucket are not encrypted. What is the MOST efficient way to enforce encryption for all future objects?

Accepted Answer

Create an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption header is not present. A bucket policy that denies PutObject unless the `x-amz-server-side-encryption` header is present enforces encryption at the API level, preventing any unencrypted object from being uploaded. This is the most efficient approach as it proactively blocks non-compliant uploads without requiring post-upload remediation or manual intervention.

Answer

Use AWS Config managed rule to identify unencrypted objects and re-upload them manually

Answer

Use S3 Inventory to list unencrypted objects and apply encryption via S3 Batch Operations

Answer

Enable default encryption on the bucket using AES-256

Question 3

A SysOps administrator must grant an IAM user the ability to start and stop specific EC2 instances, but NOT terminate them. The administrator creates a policy with the following statement. However, the user can still terminate instances. What is the MOST likely reason?

Accepted Answer

The policy does not restrict the ec2:TerminateInstances action to specific instances using a condition or ARN. EC2 actions like StopInstances and StartInstances require a resource-level permission on the instance, but TerminateInstances also requires a resource-level permission. The policy includes ec2:TerminateInstances with a condition, but if the condition is not met, the effect is Allow (since the condition is not satisfied, the statement might still allow termination if the condition is ignored). However, the key issue is that the policy uses ec2:ResourceTag as a condition key, which is valid, but the condition uses StringEquals, which requires the instance to have that tag. If the instance does not have the tag, the condition fails and the Allow does not apply, but there might be an implicit deny? Actually, the policy grants ec2:TerminateInstances with a condition that might not match, so the action is not allowed. But the user can still terminate, meaning the policy is too permissive. The most likely reason is that the policy allows ec2:TerminateInstances without proper resource restriction. Option B is incorrect because the condition key is correct. Option C is incorrect because termination is explicitly allowed with a condition. Option D is incorrect because the policy explicitly allows StartInstances and StopInstances.

Answer

The condition key ec2:ResourceTag is not a valid condition key for EC2 actions

Answer

The ec2:TerminateInstances action is not allowed in a customer-managed policy

Answer

The policy does not include an explicit deny for ec2:TerminateInstances

Question 4

A SysOps administrator needs to allow an IAM user to launch EC2 instances only in the us-east-1 region. The administrator creates a policy with a condition that uses the aws:RequestedRegion condition key. However, the user can still launch instances in other regions. What is the MOST likely reason?

Accepted Answer

The policy does not include the ec2:RunInstances action with the condition. The policy must explicitly deny or allow the ec2:RunInstances action with the aws:RequestedRegion condition. Without specifying the action, the condition key has no effect on the user's ability to launch instances. The policy likely only applies the condition to other actions or is missing the action entirely, allowing the user to bypass the region restriction.

Answer

The aws:RequestedRegion condition key is not supported for EC2

Answer

The condition key must be aws:Region instead of aws:RequestedRegion

Answer

The user has administrator access that overrides the policy

Question 5

A company has a VPC with a public and private subnet. The security team wants to restrict outbound traffic from EC2 instances in the private subnet to only allow traffic to an S3 bucket in the same account. Which of the following is the MOST secure way to achieve this?

Accepted Answer

Configure a NAT gateway in the public subnet and update the route table to send traffic to the NAT gateway, then use security groups to restrict outbound traffic. The question asks for the MOST secure way to restrict outbound traffic from private subnet EC2 instances to only an S3 bucket in the same account. Option D is the most secure because it uses a gateway VPC endpoint for S3, which keeps all traffic within the AWS network and does not require an internet gateway. The VPC endpoint policy restricts actions to the specific bucket, and the bucket policy allows only requests from the VPC endpoint, providing granular security. Option B also works by using a NAT gateway and security groups, but it requires traffic to go through the internet, which is less secure. Therefore, D is the best answer.

Answer

Use an internet gateway and a route table that directs traffic to the internet gateway, and use network ACLs to allow only S3 IP ranges

Answer

Use a VPC endpoint for S3 and attach a security group to the endpoint that allows only HTTPS traffic to the S3 prefix list

Question 6

A SysOps administrator is troubleshooting an issue where an IAM user cannot assume a role in another AWS account. The trust policy of the role allows the user's account to assume the role, and the user has a permissions policy that allows sts:AssumeRole. However, the user still gets an access denied error. What is the MOST likely cause?

Accepted Answer

The user's permissions policy does not include sts:AssumeRole for the specific role ARN. The most likely cause is that the user's IAM permissions policy grants sts:AssumeRole but does not specify the exact role ARN as the resource. Without the resource element limiting the action to the specific role, the policy may be too broad or missing the target role ARN, causing an implicit deny. AWS IAM requires that both the trust policy (on the role) and the permissions policy (on the user) explicitly allow the sts:AssumeRole action for the specific role ARN.

Answer

The trust policy specifies the user's ARN instead of the account ARN

Answer

The role requires MFA, but the user does not have MFA configured

Answer

The role's permissions policy does not include an external ID

Question 7

A SysOps administrator needs to restrict access to an S3 bucket so that only users from the corporate network IP range (203.0.113.0/24) can read objects. Which TWO elements are required to implement this? (Choose two.)

Accepted Answer

The S3 endpoint URL (s3.amazonaws.com) accessible from the corporate network. Option D is correct because an S3 bucket policy is the resource-based policy that governs access to the bucket, and it can include a Condition block using the aws:SourceIp condition key to allow s3:GetObject only when the requester's IP falls within 203.0.113.0/24. Option C is correct because the corporate network must be able to reach the S3 endpoint URL (s3.amazonaws.com, or the appropriate regional endpoint) for requests to be delivered and evaluated by that bucket policy; without network reachability to the S3 endpoint, the IP-based restriction is moot. Option A is not required because an IAM identity policy grants permissions to a principal but cannot by itself restrict access based on the source IP of the corporate network in the way a bucket policy condition does, and the scenario is about restricting bucket access, not granting a user permissions. Option B is not required because a CloudFront distribution with an origin access identity is used to serve content through CloudFront and restrict direct S3 access, not to enforce a corporate IP range for direct S3 reads. Option E is not required because a VPC gateway endpoint provides private connectivity from a VPC to S3, but it does not implement the IP-range restriction and is unnecessary for corporate network users outside that VPC.

Answer

An IAM policy that allows s3:GetObject from the corporate IP

Answer

Amazon CloudFront distribution with an origin access identity

Answer

A VPC gateway endpoint for S3

Question 8

A SysOps administrator is investigating why an EC2 instance cannot access an S3 bucket using an IAM role. The instance has an associated IAM role with a policy that allows s3:GetObject on the bucket. The bucket policy also allows access from the role. However, the instance's application still gets access denied. What is the most likely cause?

Accepted Answer

The IAM role is not associated with the instance profile used by the EC2 instance. The most likely cause is that the IAM role is not properly associated with the instance profile used by the EC2 instance. For an EC2 instance to use an IAM role, the role must be attached to an instance profile, and that instance profile must be associated with the instance. Without this association, the instance lacks credentials to assume the role. Option A is incorrect because s3:GetObject does not require ListBucket permission unless the application needs to list objects. Option C is incorrect because the bucket policy allows access from the role, so an explicit deny is not the issue. Option D is incorrect because cross-region access to S3 does not require a VPC endpoint; the instance can access S3 over the internet.

Answer

The IAM role does not have s3:ListBucket permission

Answer

The bucket policy explicitly denies access to the role

Answer

The S3 bucket is in a different region, requiring a VPC endpoint

Question 9

An organization uses AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any member account can create access keys that are more than 90 days old. What is the most efficient way to enforce this?

Accepted Answer

Create an IAM policy that denies CreateAccessKey if the user has any key older than 90 days. An IAM policy attached to all users or groups can deny the iam:CreateAccessKey action if the user has any access key older than 90 days. This is achieved using the condition key 'iam:AccessKeyAge' with a numeric condition to check the age of the access key used to authenticate the request. If that key is older than 90 days, the request is denied. This prevents users with old keys from creating new ones, effectively enforcing rotation. While this requires per-account policy attachment, it is the most direct option among those given.

Answer

Use a service control policy (SCP) to deny the iam:CreateAccessKey action unless a condition is met

Answer

Use CloudTrail to monitor CreateAccessKey events and trigger a Lambda function to disable old keys

Answer

Use AWS Config rules in each account to detect keys older than 90 days and automatically delete them

Question 10

A company wants to use AWS KMS to encrypt data at rest for an S3 bucket. The security policy requires that the CMK be rotated every year. Which of the following are true about automatic key rotation for AWS KMS customer master keys (CMKs)? (Choose TWO.)

Accepted Answer

Automatic key rotation is supported for symmetric CMKs created in KMS. Automatic key rotation in AWS KMS is supported only for symmetric customer managed keys (CMKs) that are created in KMS (not imported). This makes option B correct. Additionally, automatic key rotation can be enabled at any time for such CMKs (e.g., after creation), so option C is also true when interpreted as 'any symmetric CMK created in KMS.' Options A, D, and E are false: asymmetric CMKs do not support automatic rotation, imported CMKs do not support automatic rotation, and old backing keys are retained after rotation, not deleted.

Answer

Automatic key rotation is supported for asymmetric CMKs

Answer

Automatic key rotation is supported for imported CMKs

Answer

When a CMK is rotated, the previous backing key is deleted

Question 11

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot pull secrets from AWS Secrets Manager. The instance has an IAM role with a policy that allows secretsmanager:GetSecretValue. The secret is in the same account and region. What are possible reasons for the failure? (Choose THREE.)

Accepted Answer

The EC2 instance is in a private subnet with no route to the internet or a VPC endpoint for Secrets Manager. Option A is correct because Secrets Manager is accessed via its public HTTPS endpoint (secretsmanager.<region>.amazonaws.com); an instance in a private subnet with no NAT/IGW route and no Secrets Manager interface VPC endpoint cannot reach that endpoint, so the GetSecretValue call fails. Option D is correct because an interface VPC endpoint for Secrets Manager enforces an endpoint policy, and if that policy denies the instance's traffic (for example, by restricting principals or source security groups), the request is rejected even though the IAM role allows secretsmanager:GetSecretValue. Option E is correct because Secrets Manager encrypts secrets with a KMS key, and the caller needs kms:Decrypt on that key in addition to secretsmanager:GetSecretValue; if the secret uses a customer managed key whose key policy or IAM policy omits kms:Decrypt for the role, decryption fails. Option B is not applicable because the scenario states the secret is in the same account and region, so cross-account access is not the cause. Option C is not applicable because the scenario states the instance has an IAM role with the required policy, implying the role is attached via an instance profile and credentials are available.

Answer

The secret is in a different AWS account

Answer

The IAM role is not attached to the instance profile

Question 12

Refer to the exhibit. An IAM policy allows running instances. A user attempts to launch a t2.micro instance with a 20 GiB gp2 volume and an additional 100 GiB io1 volume. What will happen?

Accepted Answer

The launch succeeds. The policy allows running t2.micro instances (first statement) and creating volumes (second statement) without restriction on volume type or size. However, the condition on the instance resource only restricts the instance type to t2.micro; the volume resource has no condition. Therefore, both volumes are allowed. The instance launch succeeds. Option A is correct. Options B, C, D are incorrect.

Answer

The launch fails because the policy does not allow creating volumes over 100 GiB

Answer

The launch fails because the condition does not allow any volume

Answer

The launch fails because the io1 volume is not allowed

Question 13

A company has an S3 bucket configured with default encryption using SSE-S3. Users report that objects uploaded without specifying encryption are still encrypted, but some objects are accessible to unauthorized users. What is the most likely cause?

Accepted Answer

The bucket policy does not restrict access based on user permissions.. Default encryption (SSE-S3) only ensures data at rest is encrypted; it does not control who can access the objects. Unauthorized access indicates an authorization problem, meaning the bucket policy or IAM policies do not properly restrict access based on user identity. The most likely cause is that the bucket policy does not restrict access based on user permissions, allowing unintended principals to read objects.

Answer

The bucket policy is not configured to deny unencrypted uploads.

Answer

The bucket does not have MFA Delete enabled.

Answer

The bucket's block public access settings are not configured.

Question 14

A company's security team requires that all API calls to AWS services are encrypted in transit using TLS 1.2 or higher. Which TWO actions should be taken to enforce this?

Accepted Answer

Use AWS CloudTrail to monitor for API calls using TLS 1.0 and generate alerts.. Option C is correct because AWS CloudTrail records the tlsDetails field for API calls (including the TLS version and cipher suite used), so you can monitor for calls made with TLS 1.0/1.1 and generate alerts via CloudWatch Logs metric filters or EventBridge to detect non-compliant requests. Option E is correct because an AWS Organizations Service Control Policy (SCP) can include a condition such as aws:SecureTransport: false or aws:SecureTransport with a string condition to deny API requests that do not use TLS 1.2 or higher, enforcing the requirement at the organization/account level. Option A is not correct because CloudTrail alone only logs API activity; it does not enforce or block TLS versions. Option B is not correct because security groups control network traffic to EC2 instances, not the TLS version used for AWS service API calls, and they cannot inspect TLS versions. Option D is not correct because IAM policies do not support a condition key that checks the TLS version of the request; the relevant condition key is aws:SecureTransport, which only indicates whether the request used SSL/TLS, not the specific version.

Answer

Enable AWS CloudTrail to log all API calls.

Answer

Configure EC2 security groups to only allow HTTPS traffic.

Answer

Create an IAM policy that denies access unless the request uses TLS 1.2.

Question 15

Refer to the exhibit. A SysOps administrator applies this S3 bucket policy to a bucket named 'my-bucket'. The root user of account 123456789012 attempts to upload an object to the bucket without specifying encryption. What will happen?

Accepted Answer

The upload is denied because the request does not meet the condition.. The bucket policy includes a condition (typically 's3:PutObject' with a StringNotEquals on 's3:x-amz-server-side-encryption' or a Deny for unencrypted puts) that rejects uploads lacking server-side encryption headers. Because the root user of account 123456789012 is subject to the bucket policy (bucket policies apply to all principals, including the bucket owner's root), the upload without encryption fails the condition and is denied.

Answer

The upload succeeds because the root user has full access.

Answer

The upload succeeds because the bucket has default encryption enabled.

Answer

The upload is denied because the policy explicitly denies all actions.