SOA-C02 Security and Compliance Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. A SysOps administrator runs the AWS CLI command to check the event selectors for a CloudTrail trail. What does the output indicate?

Accepted Answer

The trail logs all management events.. The output shows IncludeManagementEvents: true and ReadWriteType: All, meaning the trail logs all management events (both read and write). Data events are not logged because DataResources is empty. Therefore, option A is correct. Option B is incorrect because data events are not included. Option C is incorrect because only management events are logged, not data events. Option D is incorrect because read events are also logged (ReadWriteType: All).

Answer

The trail logs both management and data events.

Answer

The trail logs all data events.

Answer

The trail logs only write management events.

Question 2

Refer to the exhibit. A SysOps administrator runs the command to list running EC2 instances. What is the purpose of the '--query' parameter?

Accepted Answer

It filters the output to show only specified fields.. The '--query' parameter in the AWS CLI filters and formats the output using JMESPath expressions, allowing you to specify exactly which fields to display. Option A is wrong because '--query' operates on the client side after the API response is received, not on the server side. Option B is wrong because it does not limit the API call; that would require a filter like '--filters Name=instance-state-name,Values=running'. Option D is wrong because '--query' does not save output to a file; that would be done with output redirection or the '--output' parameter.

Answer

It filters the results on the server side.

Answer

It limits the API call to only running instances.

Answer

It saves the output to a file.

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM users in any member account can create access keys for themselves. What is the MOST efficient way to enforce this policy across all accounts?

Accepted Answer

Create an SCP that denies the iam:CreateAccessKey action and attach it to the root organizational unit.. A service control policy (SCP) can be applied at the root or to specific OUs to deny IAM actions across all member accounts. Option A is correct because it centrally restricts the action. Option B is wrong because it only works for the master account. Option C is wrong because it requires individual account configuration. Option D is wrong because while AWS Config and Lambda can detect and remediate access key creation, this is a reactive approach and not the most efficient preventive control. SCPs proactively deny the action before it occurs, making them more efficient for enforcing this policy across all accounts.

Answer

Apply an IAM policy to the master account's root user that denies access key creation.

Answer

Enable AWS Trusted Advisor security checks and follow the recommendations.

Answer

Use AWS Config to detect access key creation and automatically delete the keys using a Lambda function.

Question 4

A SysOps administrator needs to share an encrypted AMI with a different AWS account. The AMI uses an AWS KMS key (customer managed key) for EBS encryption. What must be done to allow the target account to launch EC2 instances from the AMI?

Accepted Answer

Modify the AMI launch permissions and add the target account as a principal in the KMS key policy with kms:Decrypt permission.. To share an encrypted AMI with a different account, both the AMI permissions and the KMS key permissions must be updated. Option C is correct because it grants the required permissions. Option A is wrong because modifying launch permissions is not enough; KMS key permissions are also needed. Option B is wrong because sharing the snapshot separately does not grant KMS access. Option D is wrong because re-encrypting with a new key is unnecessary if permissions are properly set.

Answer

Share the underlying EBS snapshot with the target account.

Answer

Re-encrypt the AMI using a new KMS key that is shared with the target account.

Answer

Modify the AMI launch permissions to include the target account.

Question 5

A company's security team notices that an IAM user has been generating multiple access keys and deleting them within a short period. The SysOps administrator needs to detect and alert on this behavior. Which solution is the MOST effective?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on iam:CreateAccessKey events and sends a notification to an SNS topic.. AWS CloudTrail logs all IAM API calls, and you can create a CloudWatch Events rule that triggers on the `iam:CreateAccessKey` event. This rule can then send a notification to an SNS topic, alerting the security team. Option A is incorrect because AWS Trusted Advisor provides best-practice checks but does not monitor user behavior in real-time. Option B is incorrect because IAM Access Analyzer analyzes resource policies to identify unintended access, not user activity patterns. Option D is incorrect because AWS Config tracks resource configuration changes but does not directly react to API call events like access key creation.

Answer

Enable AWS Trusted Advisor security checks and review the report weekly.

Answer

Enable IAM Access Analyzer to analyze user activity and send alerts.

Answer

Use AWS Config to track IAM user configuration changes and trigger an alert when an access key is created.

Question 6

An organization requires that all Amazon S3 buckets be encrypted with AES-256 server-side encryption. A SysOps administrator needs to enforce this policy across the entire AWS account. Which action should be taken?

Accepted Answer

Apply an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to AES256.. A bucket policy that denies PutObject without the x-amz-server-side-encryption header set to AES256 will enforce encryption. Option A is wrong because default encryption does not prevent objects from being uploaded without encryption header. Option B is wrong because CloudTrail logs but does not enforce. Option C is wrong because S3 Inventory does not enforce.

Answer

Enable default encryption on all existing and future S3 buckets.

Answer

Use AWS CloudTrail to monitor uploads without encryption and alert the administrator.

Answer

Use S3 Inventory to list unencrypted objects and remediate them manually.

Question 7

A SysOps administrator needs to provide a developer from another AWS account access to an S3 bucket in the administrator's account. The developer must be able to list objects and get objects from the bucket. The administrator does NOT want to share AWS access keys. Which solution meets these requirements?

Accepted Answer

Attach a bucket policy to the S3 bucket that grants s3:ListBucket and s3:GetObject to the developer's IAM user ARN.. Attaching a bucket policy that grants s3:ListBucket and s3:GetObject to the developer's IAM user ARN allows cross-account access without sharing access keys. Option A is wrong because sharing access keys violates security best practices. Option C is wrong because pre-signed URLs are temporary and require generating a URL for each object, making them impractical for listing and bulk access. Option D is wrong because granting access to the root user of the developer's account is overly permissive and insecure, and a bucket policy should specify the exact IAM user or role.

Answer

Create an IAM user in the administrator's account and share the access key and secret key with the developer.

Answer

Generate pre-signed URLs for all objects and share them with the developer.

Answer

Grant the developer's AWS account root user access to the bucket using a bucket policy.

Question 8

A SysOps administrator is configuring a new AWS account and wants to set up a secure password policy for IAM users. The policy must require at least 12 characters, one uppercase letter, one number, and must prevent password reuse. Where should this policy be configured?

Accepted Answer

In the IAM console under Account settings, set the password policy.. AWS IAM password policies are configured at the account level in the IAM console under Account settings or via the update-account-password-policy API. Option A is wrong because SCPs can restrict IAM actions but do not set password policies. Option C is wrong because the root user does not have a configurable password policy. Option D is wrong because IAM roles do not have passwords.

Answer

Apply a service control policy (SCP) that enforces password complexity.

Answer

Set a password policy on the AWS account root user.

Answer

Create an IAM role with a password policy attached.

Question 9

An organization uses AWS KMS to encrypt data in S3. A SysOps administrator needs to ensure that KMS keys cannot be deleted accidentally. What is the MOST effective way to protect against accidental key deletion?

Accepted Answer

Set a high waiting period (e.g., 30 days) for key deletion and require multi-factor authentication (MFA) for the deletion.. AWS KMS allows you to set a waiting period (customizable up to 30 days) for key deletion and optionally require multi-factor authentication (MFA) for the deletion. This provides a safeguard against accidental deletion, as the key is disabled during the waiting period and deletion can be canceled. Option A is wrong because disabling a key does not prevent deletion; the key can still be scheduled for deletion. Option B is wrong because KMS keys are not exportable and cannot be backed up. Option C is wrong because SCPs apply at the account level and cannot restrict actions within the same account; they are used for cross-account policies.

Answer

Disable the KMS key so it cannot be used but can still be deleted.

Answer

Create a backup of the KMS key in another AWS Region.

Answer

Use a service control policy (SCP) to deny the kms:ScheduleKeyDeletion action.

Question 10

A company has an S3 bucket that stores sensitive data. The security team requires that all data be encrypted at rest and that all access be logged. Which TWO actions should the SysOps administrator take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable default encryption on the S3 bucket.. Enable default encryption (Option C) ensures all objects uploaded to the bucket are encrypted at rest, meeting the encryption requirement. Enable S3 server access logs (Option E) logs all requests, meeting the logging requirement. Option A (S3 Transfer Acceleration) enhances transfer speed but does not provide encryption or logging. Option B (S3 Replication) duplicates objects but does not enforce encryption. Option D (S3 Object Lock) prevents object deletion for compliance but does not address encryption or logging.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable S3 Replication to replicate objects to another bucket.

Answer

Enable S3 Object Lock.

Question 11

A SysOps administrator is designing a solution to manage secrets (e.g., database credentials) for a multi-tier application running on EC2 instances. The solution must rotate secrets automatically and provide fine-grained access control. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (option C) can rotate secrets automatically and provides fine-grained access control via IAM policies. IAM roles for EC2 (option E) allow instances to assume roles, providing secure access to secrets without storing credentials on the instance. AWS KMS (option A) is used for encryption keys, not secret rotation. AWS CloudHSM (option B) is a hardware security module, not a secret management service. AWS Systems Manager Parameter Store (option D) can store secrets but does not support automatic rotation.

Answer

AWS KMS

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 12

A company wants to audit all API calls made in their AWS account for security analysis. They need to record both management events and data events. Which THREE steps should be taken to set up comprehensive logging? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail to record data events for S3 and Lambda.. To record data events for specific services like S3 and Lambda, you must enable them in the CloudTrail trail configuration. Data events capture detailed resource operations such as GetObject on S3 or Invoke on Lambda. Option B is correct because CloudTrail records management events by default, which include all control plane operations like creating or deleting resources, and are essential for auditing account-level activities. Option E is correct because CloudTrail trails deliver log files to an S3 bucket by default; this provides durable, cost-effective storage for long-term analysis. Option C is incorrect because VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, not API calls. Option D is incorrect while CloudTrail logs can be sent to CloudWatch Logs for real-time monitoring and alerting, the primary destination for recording logs is the S3 bucket; CloudWatch Logs is an optional additional destination, not the main recording mechanism.

Answer

Enable VPC Flow Logs to capture API call metadata.

Answer

Send the log files to Amazon CloudWatch Logs for real-time analysis.

Question 13

A company wants to securely store database credentials used by an application running on Amazon EC2. Which AWS service should be used to rotate and manage access to these secrets?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager provides automatic rotation of secrets, while Systems Manager Parameter Store does not offer native rotation. KMS is for encryption keys, not secrets. IAM is for access management, not secret storage.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 14

A SysOps administrator needs to ensure that an Amazon RDS instance is encrypted at rest. The instance is already provisioned unencrypted. What is the correct approach to enable encryption?

Accepted Answer

Create a snapshot of the instance and restore it with encryption enabled. RDS encryption can only be enabled at creation time. For an existing unencrypted instance, you must create a snapshot, copy it with encryption, and restore from that encrypted snapshot. Modifying the instance or enabling encryption on the fly is not supported.

Answer

Use AWS KMS to encrypt the underlying EBS volumes of the RDS instance

Answer

Enable encryption using the AWS CLI command modify-db-instance

Answer

Modify the RDS instance and enable encryption in the configuration

Question 15

A company uses AWS Organizations to manage multiple accounts. The security team wants to restrict all accounts from using specific AWS services unless explicitly allowed. Which feature should be used?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are used in AWS Organizations to define the maximum permissions for accounts in the organization. SCPs can deny or allow services at the organization, OU, or account level. IAM policies are for individual users/roles, not for account-wide restrictions. Resource-based policies are for specific resources. AWS Config rules evaluate compliance but do not restrict usage.

Answer

Resource-based policies

Answer

IAM permissions boundaries

Answer

AWS Config rules