SOA-C02 Security and Compliance Practice Test 5 — 15 Questions

Question 1

An application running on Amazon EC2 needs to encrypt data before writing to Amazon S3. The encryption key must be rotated every 90 days and access to the key must be auditable. Which solution meets these requirements?

Accepted Answer

Use AWS KMS customer master key (CMK) with automatic rotation enabled and client-side encryption.. Option C is correct because AWS KMS provides managed keys with automatic rotation (optional) and integrates with CloudTrail for auditing. Option A is wrong because S3 server-side encryption with SSE-S3 does not allow customer-controlled key rotation. Option B is wrong because client-side encryption with a master key stored on the instance is not auditable and key rotation is manual. Option D is wrong because SSL/TLS is for encryption in transit, not at rest.

Answer

Use client-side encryption with a master key stored on the EC2 instance.

Answer

Use SSL/TLS to encrypt data in transit from EC2 to S3.

Answer

Use Amazon S3 server-side encryption with SSE-S3.

Question 2

A SysOps administrator needs to restrict access to an Amazon S3 bucket so that only requests from a specific VPC endpoint are allowed. Which policy statement should be added to the bucket policy?

Accepted Answer

Condition: { StringEquals: { 'aws:SourceVpce': 'vpce-12345' } }. Option B is correct because the condition 'aws:SourceVpce' with the VPC endpoint ID restricts access to requests originating from that endpoint. Option A is wrong because 'aws:SourceVpc' restricts to a VPC, not a specific endpoint. Option C is wrong because 'aws:VpcSourceIp' is not a valid condition key. Option D is wrong because 'ec2:Vpc' is not a valid condition key for S3.

Answer

Condition: { StringEquals: { 'aws:SourceVpc': 'vpc-12345' } }

Answer

Condition: { StringEquals: { 'ec2:Vpc': 'vpc-12345' } }

Answer

Condition: { IpAddress: { 'aws:VpcSourceIp': '10.0.0.0/16' } }

Question 3

A company requires that all AWS account activity be recorded and the logs be stored in a centralized S3 bucket for analysis. Which two AWS services should be used together to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon S3. Option D is correct because AWS CloudTrail records API activity and can deliver logs to an S3 bucket. Option A is wrong because Amazon GuardDuty is a threat detection service, not a logging service. Option B is wrong because AWS Config records resource configurations, not API activity. Option C is wrong because Amazon Inspector is for vulnerability assessment. Option E is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

Amazon GuardDuty and Amazon S3

Answer

AWS Config and Amazon S3

Answer

Amazon Inspector and Amazon S3

Answer

VPC Flow Logs and Amazon S3

Question 4

A company uses AWS Key Management Service (KMS) to encrypt data in Amazon S3. They want to ensure that the KMS key can only be used from within a specific VPC. How can this be accomplished?

Accepted Answer

Add a condition in the KMS key policy using 'aws:SourceVpc' to restrict usage to the VPC.. Option D is correct because a KMS key policy can use the 'aws:SourceVpc' condition to restrict usage to requests originating from a specific VPC. Option A is wrong because S3 bucket policies cannot restrict KMS key usage. Option B is wrong because IAM policies cannot restrict based on VPC for KMS actions. Option C is wrong because network ACLs control network traffic, not KMS API calls.

Answer

Add a condition in the S3 bucket policy to allow only requests from the VPC.

Answer

Use an IAM policy with a condition that requires the request to come from the VPC.

Answer

Configure a network ACL that blocks all traffic to KMS except from the VPC.

Question 5

A SysOps administrator is troubleshooting an issue where an IAM user is unable to launch an EC2 instance in a specific subnet. The user has the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:Subnet": "subnet-12345"
        }
      }
    }
  ]
}

What is the likely cause of the failure?

Accepted Answer

The user is not specifying the subnet ID when launching the instance.. Option B is correct because the 'ec2:Subnet' condition key requires the user to specify the subnet ID in the RunInstances call. If the user does not specify a subnet (e.g., using the default VPC), the condition fails. Option A is wrong because the policy allows RunInstances, not just Describe. Option C is wrong because the condition is explicitly for subnet-12345, so it does not deny all subnets. Option D is wrong because the condition key 'ec2:Subnet' is valid for RunInstances.

Answer

The policy does not allow the 'ec2:DescribeSubnets' action, so the user cannot list subnets.

Answer

The policy denies all subnets except subnet-12345.

Answer

The condition key 'ec2:Subnet' is not supported for RunInstances.

Question 6

A company wants to ensure that all data in Amazon S3 is encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which bucket policy statement should be used to deny any PUT request that does not include the 'x-amz-server-side-encryption' header with value 'aws:kms'?

Accepted Answer

Condition: { StringNotEquals: { 's3:x-amz-server-side-encryption': 'aws:kms' } }. Option A is correct because the condition 's3:x-amz-server-side-encryption' checks for the header value. Denying the request when the string does not equal 'aws:kms' enforces SSE-KMS. Option B is wrong because it denies when the value equals 'aws:kms', which would block encryption. Option C is wrong because it checks 's3:x-amz-server-side-encryption-aws-kms-key-id', which is not the header for encryption type. Option D is wrong because it checks 's3:ServerSideEncryption', which is not a valid condition key.

Answer

Condition: { StringNotEquals: { 's3:x-amz-server-side-encryption-aws-kms-key-id': 'alias/aws/s3' } }

Answer

Condition: { StringNotEquals: { 's3:ServerSideEncryption': 'KMS' } }

Answer

Condition: { StringEquals: { 's3:x-amz-server-side-encryption': 'aws:kms' } }

Question 7

A company is designing a secure application architecture. They need to ensure that sensitive data stored in Amazon S3 is not accessible from the public internet. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Use an S3 VPC Gateway Endpoint to restrict access to the VPC.. Option B is correct because blocking public access at the bucket or account level prevents public access. Option C is correct because using S3 VPC Gateway Endpoint ensures access is only from within the VPC. Option A is wrong because encrypting data does not prevent public access. Option D is wrong because CloudFront with OAI can provide secure access but does not by itself block public internet access if the bucket is public. Option E is wrong because MFA Delete is for deletion protection, not access control.

Answer

Enable default encryption on the bucket.

Answer

Enable MFA Delete on the bucket.

Answer

Use Amazon CloudFront with Origin Access Identity (OAI).

Question 8

A SysOps administrator needs to audit all changes to IAM resources in their AWS account. Which THREE AWS services can be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records IAM API calls. Option C is correct because AWS Config can track changes to IAM resources and trigger rules. Option D is correct because Amazon CloudWatch Logs can store and monitor CloudTrail logs. Option B is wrong because Amazon GuardDuty is for threat detection, not auditing changes. Option E is wrong because AWS Trusted Advisor is for best-practice checks.

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 9

A company uses AWS Organizations and wants to restrict the use of specific AWS services across all member accounts. Which TWO methods can be used to enforce these restrictions? (Choose TWO.)

Accepted Answer

Create IAM policies in each account that deny the service actions and attach them to all IAM users and roles.. Option A is correct because SCPs can deny access to services at the organization level. Option C is correct because IAM policies in each account can deny actions, but they need to be applied consistently. Option B is wrong because AWS Config rules can detect but not enforce restrictions. Option D is wrong because AWS Service Catalog provisions services, it does not restrict them. Option E is wrong because VPC endpoints are for network connectivity, not service restrictions.

Answer

Use AWS Config rules to automatically disable non-compliant services.

Answer

Use AWS Service Catalog to block the use of disallowed services.

Answer

Configure VPC endpoints to block traffic to the disallowed services.

Question 10

A company wants to ensure that their Amazon S3 bucket policy only allows access from a specific VPC endpoint. Which TWO condition keys can be used in the bucket policy? (Choose TWO.)

Accepted Answer

aws:SourceVpc. Option B is correct because 'aws:SourceVpce' restricts to a specific VPC endpoint. Option C is correct because 'aws:SourceVpc' restricts to a specific VPC (all endpoints in that VPC). Option A is wrong because 'aws:SourceIp' is for IP addresses, not VPC endpoints. Option D is wrong because 's3:SourceVpce' is not a valid condition key. Option E is wrong because 'ec2:Vpc' is for EC2, not S3.

Answer

s3:SourceVpce

Answer

aws:SourceIp

Answer

ec2:Vpc

Question 11

A company has the following S3 bucket policy attached to a bucket named 'example-bucket'. A user is unable to download an object from the bucket using an HTTP URL (not HTTPS). What is the cause?

Accepted Answer

The Deny statement blocks all S3 actions when the request is not using HTTPS.. Option C is correct because the first statement denies all s3:* actions when SecureTransport is false (i.e., HTTP). The second statement allows GetObject to everyone, but the Deny statement takes precedence. Option A is wrong because the bucket policy does not require SSE. Option B is wrong because the policy allows GetObject to everyone. Option D is wrong because the Deny is for all s3 actions, not just PutObject.

Answer

The bucket policy does not allow GetObject for anonymous users.

Answer

The bucket policy requires server-side encryption for all requests.

Answer

The Deny statement only applies to PutObject, not GetObject.

Question 12

A SysOps administrator is investigating a security incident where an unauthorized key pair was created. The CloudTrail lookup command output is shown. The administrator wants to find the source IP address of the 'admin' user who created the key pair. Which field in the 'CloudTrailEvent' JSON should the administrator examine?

Accepted Answer

sourceIPAddress. Option B is correct because the source IP address is contained in the 'sourceIPAddress' field within the CloudTrail event JSON. Option A is wrong because 'userIdentity' contains information about the user, not the IP. Option C is wrong because 'eventTime' is the timestamp. Option D is wrong because 'requestParameters' contains the parameters of the API call, not the IP.

Answer

requestParameters

Answer

userIdentity

Answer

eventTime

Question 13

A company's security team notices that an IAM user has been making unauthorized API calls from an IP address outside the company's VPN. The team wants to immediately block all API calls from that specific IP address for all users. Which action should be taken?

Accepted Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the root organizational unit.. Option D is correct because an SCP applied at the root OU can deny access based on source IP for all accounts in the organization. Option A is wrong because modifying the AWS-managed policy is not allowed. Option B is wrong because a service control policy cannot be attached to a user directly. Option C is wrong because IAM policies can only be attached to users, groups, or roles, not to an organization root.

Answer

Create a new IAM policy that denies access from the IP address and attach it to all users.

Answer

Create an IAM policy that denies access from the IP address and attach it to the organization root.

Answer

Create a service control policy (SCP) that denies access from the IP address and attach it to the IAM user.

Question 14

A SysOps administrator is tasked with encrypting data at rest for an Amazon S3 bucket that stores sensitive customer information. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption solution meets these requirements?

Accepted Answer

Use server-side encryption with Amazon S3-managed keys (SSE-S3).. Option B is correct because SSE-S3 provides server-side encryption with Amazon S3-managed keys, and AWS automatically rotates the keys. Option A is wrong because SSE-C requires the customer to manage and provide the encryption keys. Option C is wrong because SSE-KMS uses customer-managed KMS keys, which are not automatically rotated unless enabled. Option D is wrong because client-side encryption is not managed by AWS.

Answer

Use client-side encryption with AWS KMS.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use server-side encryption with AWS KMS (SSE-KMS).

Question 15

A company wants to allow a developer to deploy applications using AWS CloudFormation but restrict the developer from creating or modifying IAM resources. Which IAM policy should be used?

Accepted Answer

Allow cloudformation:* and deny iam:*. Option A is correct because it allows all CloudFormation actions but denies IAM-related actions. Option B is wrong because it does not explicitly deny IAM actions, so the developer could still create IAM resources if the policy allows it. Option C is wrong because it denies all actions on CloudFormation stacks, which is too restrictive. Option D is wrong because it allows all actions on IAM, which is the opposite of what is needed.

Answer

Allow iam:*

Answer

Deny cloudformation:*

Answer

Allow cloudformation:* only