SOA-C02 Security and Compliance Practice Test 5 — 15 Questions

Question 1

A company wants to grant an IAM role in Account A access to an S3 bucket in Account B. What must be configured?

Accepted Answer

A bucket policy in Account B granting access to the IAM role, and a trust policy in Account A allowing the role to assume the permissions.. To grant an IAM role in Account A access to an S3 bucket in Account B, you need two policies: a bucket policy in Account B that grants access to the IAM role, and a trust policy (also known as a permissions policy) in Account A that allows the role to assume the necessary permissions. Option B correctly describes this combination. Option A is wrong because a bucket policy alone is insufficient; the role must have permission to assume the access. Option C is wrong because a bucket policy alone is insufficient; the role needs a trust policy in Account A. Option D is wrong because an IAM role policy in Account A alone is insufficient; the bucket policy must explicitly grant access to the role.

Answer

A trust policy in Account B allowing the IAM role to access the bucket.

Answer

A bucket policy in Account B allowing access from the IAM role.

Answer

An IAM role in Account A with a policy allowing access to the bucket.

Question 2

A SysOps administrator discovers that an EC2 instance was compromised because the SSH key pair was leaked. The administrator wants to ensure that future access to EC2 instances is secured using a method that does not rely on static keys. Which solution should the administrator implement?

Accepted Answer

Use EC2 Instance Connect to connect to instances.. EC2 Instance Connect allows you to connect to EC2 instances using IAM policies and does not require managing or distributing static SSH key pairs. This eliminates the risk of key leakage. Option A (bastion host with limited IP range) still relies on SSH key pairs for authentication. Option B (create new key pair) continues to use static keys and does not address the root cause. Option C (Systems Manager Session Manager) provides secure access without keys, but it requires the SSM Agent and an IAM instance role, and is not as directly focused on SSH key replacement as EC2 Instance Connect. Therefore, Option D is the best solution.

Answer

Use a bastion host with a security group that allows SSH from a limited IP range.

Answer

Create a new key pair and distribute it securely to authorized users.

Answer

Use AWS Systems Manager Session Manager to connect to instances.

Question 3

A company's compliance team requires that all changes to IAM policies be logged and immediately alerted. Which AWS solution should be used?

Accepted Answer

Use AWS CloudTrail to log API calls and Amazon CloudWatch Events to send alerts.. AWS CloudTrail logs all API calls, including IAM policy changes, and Amazon CloudWatch Events can be configured to trigger alerts in real-time based on those logged events. Option A is incorrect because AWS Config rules are designed for compliance evaluation and configuration change tracking, not for real-time alerting on IAM policy changes. Option B is incorrect because Amazon CloudWatch Logs does not directly capture API calls; it can store logs from CloudTrail, but the primary logging service for API calls is CloudTrail. Option C is incorrect because Amazon GuardDuty is a threat detection service, not a logging and alerting solution for IAM policy changes.

Answer

Use AWS Config rules to monitor IAM policy changes and send notifications.

Answer

Use Amazon CloudWatch Logs to capture IAM policy changes and create metric filters.

Answer

Use Amazon GuardDuty to detect unauthorized IAM policy changes.

Question 4

A SysOps administrator needs to ensure that an EC2 instance can access an S3 bucket without storing AWS credentials on the instance. What should the administrator do?

Accepted Answer

Create an IAM role with S3 access and attach it to the instance profile.. An IAM role attached to the EC2 instance provides temporary credentials via the instance profile. Option A is wrong because a bucket policy alone does not provide credentials to the instance, and relying on the public IP is not secure. Option C is wrong because storing access keys on the instance is insecure and against best practices. Option D is wrong because security groups control network traffic, not authentication or authorization to S3.

Answer

Create a bucket policy that allows access from the instance's public IP.

Answer

Store the access key and secret key in a file on the instance.

Answer

Configure the security group to allow outbound traffic to S3.

Question 5

A company requires that all API calls to AWS services be logged for compliance. The logs must be stored in a centralized S3 bucket with server-side encryption enabled. Which AWS service should be used to capture the API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls and can deliver logs to an S3 bucket with SSE. Option A is wrong because AWS Config records resource configuration changes, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because Amazon CloudWatch Logs can store logs but is not the primary service for capturing API calls.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 6

An administrator needs to grant an IAM user the ability to stop and start EC2 instances, but only for instances tagged with 'Environment:Production'. Which IAM policy element should be used to enforce this condition?

Accepted Answer

Condition. The Condition element in an IAM policy allows specifying conditions, such as restricting actions to instances with a specific tag (e.g., 'Environment:Production'). Option A is incorrect because Effect determines whether the policy allows or denies access. Option B is incorrect because Resource specifies the ARN of the resources the policy applies to. Option C is incorrect because Action specifies the specific operations (e.g., ec2:StopInstances) that are allowed or denied.

Answer

Effect

Answer

Resource

Answer

Action

Question 7

A company uses AWS Organizations with SCPs to restrict member accounts. The security team wants to prevent all users in the 'Developers' OU from deleting S3 buckets, except for the root user of the management account. How should this be implemented?

Accepted Answer

Attach an SCP that denies s3:DeleteBucket to the Developers OU. The management account root is not affected by SCPs.. SCPs can be attached to an OU to deny actions to all principals in member accounts, including the root user. The management account root user is explicitly exempt from SCPs, so it is not affected. Option A is incorrect because IAM policies cannot restrict the root user, and the root user in member accounts can still be restricted by SCPs. Option C is incorrect because SCPs cannot conditionally exclude the root user; they apply to all principals. Option D is incorrect because SCPs affect the root user in member accounts, not just IAM users.

Answer

Create an IAM policy that denies s3:DeleteBucket and attach it to all IAM users. The root user is not affected by IAM policies.

Answer

Attach an SCP that denies s3:DeleteBucket except when called by root user.

Answer

Attach an SCP that denies s3:DeleteBucket to the Developers OU. The root user in member accounts is not affected.

Question 8

A SysOps administrator needs to ensure that data in an S3 bucket is encrypted at rest. The bucket already has server-side encryption with S3 managed keys (SSE-S3) enabled. Which additional step is required to enforce encryption for all objects?

Accepted Answer

Add a bucket policy that denies PutObject without encryption.. A bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, thereby enforcing encryption for all uploads. Option B is incorrect because CloudTrail logs API calls but does not enforce encryption. Option C is incorrect because enabling default encryption on the bucket only encrypts objects that are uploaded without specifying encryption, but it does not prevent unencrypted uploads; a bucket policy is needed to enforce encryption. Option D is incorrect because versioning allows multiple versions of objects but does not enforce encryption.

Answer

Enable CloudTrail to log unencrypted uploads.

Answer

Enable default encryption on the bucket.

Answer

Enable versioning on the bucket.

Question 9

A company has a legacy application that requires access to an S3 bucket using an IAM user's access keys. The security team wants to rotate the access keys every 90 days automatically. What is the MOST efficient way to achieve this?

Accepted Answer

Store the access keys in AWS Secrets Manager and use automatic rotation.. AWS Secrets Manager provides built-in automatic rotation for IAM user access keys, allowing you to set a 90-day rotation schedule without custom code. Option A is incorrect because while AWS Lambda with a scheduled CloudWatch Events rule could rotate keys, it requires custom code and is less efficient than the managed rotation in Secrets Manager. Option B is incorrect because a script on an EC2 instance using cron would require additional infrastructure and maintenance. Option D is incorrect because there is no built-in IAM access key rotation in the IAM console; you must manually rotate keys each time.

Answer

Use AWS Lambda with a scheduled CloudWatch Events rule to rotate the keys.

Answer

Create a script that runs on an EC2 instance using cron to rotate the keys.

Answer

Enable IAM access key rotation in the IAM console.

Question 10

An administrator notices that an EC2 instance has been compromised. The instance is part of an Auto Scaling group. What should the administrator do FIRST to contain the incident?

Accepted Answer

Detach the instance from the Auto Scaling group and apply a security group that denies all traffic.. The correct first step is to detach the instance from the Auto Scaling group and apply a security group that denies all traffic. This isolates the compromised instance, preventing further damage while preserving evidence for forensic analysis. Option A is incorrect because changing the launch configuration does not affect running instances. Option B is incorrect because immediate termination may destroy evidence. Option D is incorrect because deleting the Auto Scaling group is an extreme measure and not the immediate containment step.

Answer

Update the Auto Scaling group's launch configuration to use a different AMI.

Answer

Terminate the instance immediately.

Answer

Delete the Auto Scaling group.

Question 11

A company wants to allow an external auditor to read objects in a specific S3 bucket for 30 days. The auditor does not have an AWS account. Which method should be used?

Accepted Answer

Generate presigned URLs for the objects.. Presigned URLs grant temporary access to specific objects without requiring AWS credentials. Option A is wrong because bucket policies require the auditor to have AWS credentials. Option B is wrong because IAM users require credentials. Option D is wrong because CloudFront does not provide temporary access by itself.

Answer

Create a bucket policy that allows the auditor's IP address.

Answer

Create an IAM user for the auditor and share the credentials.

Answer

Use CloudFront signed URLs.

Question 12

An organization wants to enforce that all IAM users have multi-factor authentication (MFA) enabled before they can perform any action except changing their own password. Which IAM policy element is MOST appropriate?

Accepted Answer

Use a Condition element with 'aws:MultiFactorAuthPresent' set to 'true' in a Deny policy.. Using a Condition element with 'aws:MultiFactorAuthPresent' set to 'true' in a Deny policy effectively requires MFA because it denies actions if MFA is not present, except for allowed exceptions. Option B is incorrect because an Action element alone does not enforce MFA; it only specifies which actions are allowed or denied. Option C is incorrect because a NotAction element allows actions that are not listed, but it does not enforce MFA conditions. Option D is incorrect because a Resource element defines which resources the policy applies to, but it does not enforce MFA requirements.

Answer

Use an Action element to allow only MFA actions.

Answer

Use a NotAction element to allow password change without MFA.

Answer

Use a Resource element to limit access to MFA-enabled users.

Question 13

Which TWO actions should a SysOps administrator take to secure an AWS account root user? (Choose two.)

Accepted Answer

Enable multi-factor authentication (MFA) for the root user.. Enabling MFA on the root user adds an extra layer of security. Option E is correct because AWS recommends not creating access keys for the root user; instead, use IAM users with appropriate permissions. Option A is incorrect because the root user cannot be deleted; you can only change its password or remove its access keys. Option B is incorrect because service control policies (SCPs) do not apply to the root user in the management account. Option D is incorrect because while CloudTrail can monitor root user activity, it is not a direct security action to secure the root user; the question asks for actions to secure the root user, and enabling CloudTrail is monitoring, not securing.

Answer

Delete the root user after creating an admin IAM user.

Answer

Apply a service control policy (SCP) to restrict the root user.

Answer

Enable CloudTrail to monitor root user activity.

Question 14

Which THREE are valid methods to control access to an S3 bucket? (Choose three.)

Accepted Answer

Access control lists (ACLs). VPC Flow Logs capture IP traffic information but do not control access to S3. Option B is correct because access control lists (ACLs) are a legacy method to manage permissions on S3 objects. Option C is correct because bucket policies are JSON-based policies that define permissions for the entire bucket. Option D is correct because IAM user policies can grant users access to S3 buckets and objects. Option E is incorrect because CloudWatch Logs monitor log data and are not used for access control.

Answer

VPC Flow Logs

Answer

CloudWatch Logs

Question 15

Which TWO services can be used to centrally manage cryptographic keys for AWS services? (Choose two.)

Accepted Answer

AWS CloudHSM. Options A (AWS CloudHSM) and D (AWS KMS) are correct. AWS CloudHSM provides dedicated hardware security modules (HSMs) for centralized key management, allowing you to generate and use your own encryption keys. AWS KMS is a managed service that enables you to create, control, and rotate encryption keys for AWS services and applications. Option B (ACM) is incorrect because it manages SSL/TLS certificates, not cryptographic keys. Option C (IAM) is incorrect because it manages identities and access permissions, not keys. Option E (Secrets Manager) is incorrect because it manages secrets like database credentials, not cryptographic keys.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Secrets Manager