SOA-C02 Security and Compliance Practice Test 7 — 15 Questions

Question 1

An application running on Amazon EC2 needs to access an S3 bucket. The SysOps administrator wants to ensure that only that specific EC2 instance can access the bucket, without storing any long-term credentials on the instance. What is the most secure way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an IAM role to the EC2 instance using an instance profile and grant the role S3 access. Using an instance profile with an IAM role is the most secure method. The instance profile is attached to the EC2 instance, and the role provides temporary credentials via the metadata service. The S3 bucket policy can then restrict access to that specific IAM role. Storing access keys on the instance is insecure. Using pre-signed URLs is for individual objects, not ongoing access. A resource-based policy on the EC2 instance is not applicable.

Answer

Configure a resource-based policy on the EC2 instance to allow S3 access

Answer

Create an IAM user with S3 access and store the access keys in the instance's user data

Answer

Generate pre-signed URLs for each S3 object the application needs to access

Question 2

A SysOps administrator needs to audit all API calls made in the AWS account, including actions performed by the root user. Which service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls, including those by the root user, and delivers log files to an S3 bucket. CloudWatch Logs is for log monitoring, not auditing API calls. AWS Config records resource configuration changes, not API calls. VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 3

A company requires that all S3 buckets be tagged with a 'CostCenter' tag. A SysOps administrator needs to enforce this and prevent creation of untagged buckets. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) that denies s3:CreateBucket unless the request includes the required tag. AWS Organizations SCPs can be used to deny actions that do not meet certain conditions, such as requiring specific tags. An SCP with a condition for 'aws:RequestTag' can enforce tagging at bucket creation. IAM policies can also enforce tagging for specific users, but SCPs apply to all accounts in the organization. AWS Config rules can detect non-compliant resources but cannot prevent creation. CloudTrail is for logging, not enforcement.

Answer

Create an IAM policy that allows s3:CreateBucket only if the bucket has the tag, and attach it to all users

Answer

Enable AWS CloudTrail to log bucket creation and review logs daily

Answer

Use an AWS Config rule to automatically delete untagged buckets

Question 4

A SysOps administrator receives an alert that an IAM user's access key was used from an unexpected geographic location. What should the administrator do to prevent future unauthorized use?

Accepted Answer

Add a condition to the IAM user's policy that denies access from outside the expected region. The best practice is to use a conditional policy that denies access based on the user's source IP or geographic location. This can be attached to the IAM user or group. Simply deleting the key may not be sufficient if the user needs it; the underlying issue is lack of location-based restriction. Disabling the account or rotating the key are reactive measures, not preventive.

Answer

Disable the IAM user's account immediately

Answer

Enable multi-factor authentication (MFA) for the IAM user

Answer

Delete the IAM user's access key and create a new one

Question 5

A company wants to ensure that its AWS resources are compliant with the CIS AWS Foundations Benchmark. Which TWO AWS services can be used to automate compliance checks and remediation?

Accepted Answer

AWS Config. AWS Config rules can evaluate resource configurations against desired policies (e.g., CIS benchmarks) and trigger automatic remediation actions via Systems Manager Automation. AWS Security Hub provides a consolidated view of security findings across accounts and can also perform automated checks against standards like CIS. CloudTrail and GuardDuty are not specifically for compliance automation; Inspector is for vulnerability assessment, not compliance.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Question 6

A SysOps administrator needs to securely transfer a large dataset from an on-premises server to an Amazon S3 bucket. The data is sensitive and must be encrypted in transit and at rest. Which THREE steps should the administrator take? (Choose three.)

Accepted Answer

Create an S3 endpoint policy that only allows access from the on-premises IP range. To securely transfer data, you should enable S3 bucket-side encryption (SSE-KMS or SSE-S3) for encryption at rest, use an S3 endpoint policy to restrict access (e.g., only allow from specific VPC), and use AWS CLI with --sse flag to enforce server-side encryption during upload. While HTTPS is mandatory, it's implicitly used; the explicit steps are the other three. Using public endpoints would expose data; disabling HTTPS would break encryption in transit.

Answer

Disable public access to the S3 bucket

Answer

Use an S3 bucket policy that denies requests unless they are made over HTTPS

Question 7

A SysOps administrator is configuring a new VPC and wants to ensure that only traffic from a specific IP address range can access an EC2 instance via SSH. Which TWO components should be configured? (Choose two.)

Accepted Answer

Network ACL (NACL). To restrict SSH access to a specific IP range, you configure a network ACL at the subnet level and a security group at the instance level. NACLs are stateless and evaluate rules in order; security groups are stateful. Both can allow inbound SSH from the specific IP range. Internet gateway enables internet access but does not filter by IP. Route tables direct traffic but do not filter. VPC endpoint is for private connectivity to AWS services.

Answer

VPC endpoint

Answer

Internet gateway

Answer

Route table

Question 8

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files from the S3 bucket. Which THREE actions should be taken? (Choose three.)

Accepted Answer

Enable CloudTrail log file validation. To protect CloudTrail logs, you should configure an SCP to deny CloudTrail disabling, enable log file validation to detect tampering, and use an S3 bucket policy that denies delete object permissions to all principals except the CloudTrail service. MFA delete adds another layer but is not a direct step for CloudTrail. CloudWatch Logs is for monitoring, not protection.

Answer

Send CloudTrail logs to CloudWatch Logs for real-time monitoring

Answer

Enable MFA delete on the S3 bucket

Question 9

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets in the organization have server-side encryption enabled. What is the MOST efficient way to achieve this?

Accepted Answer

Attach a service control policy (SCP) that denies s3:PutBucketEncryption and s3:CreateBucket actions unless encryption is specified.. Service control policies (SCPs) can be applied to the root OU or specific accounts to deny s3:PutBucketEncryption and s3:CreateBucket actions unless encryption is specified. This proactively prevents any bucket from being created or modified without server-side encryption, enforcing encryption across the entire organization. Option B is incorrect because Trusted Advisor only provides checks and notifications; it does not enforce encryption. Option C is incorrect because AWS Config rules can detect non-compliant buckets but require additional setup like auto-remediation, and they are not as efficient as SCPs for prevention. Option D is incorrect because bucket policies are applied per bucket and cannot be enforced globally across all accounts.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets and notify the account owners.

Answer

Use AWS Config rules to automatically remediate non-compliant buckets.

Answer

Apply a bucket policy to each bucket requiring server-side encryption for all uploads.

Question 10

A SysOps administrator needs to provide temporary access to an S3 bucket for a third-party auditor. The access must expire after 24 hours. Which solution should the administrator use?

Accepted Answer

Use AWS Security Token Service (STS) to issue temporary credentials that expire after 24 hours.. AWS STS can issue temporary credentials with a configurable expiration, in this case 24 hours, which aligns with the requirement for temporary access that expires. Option A is incorrect because creating an IAM user provides long-term credentials, not temporary. Option B is incorrect because a bucket policy granting access to the auditor's AWS account provides persistent access unless explicitly revoked, and it does not inherently expire. Option D is incorrect because a pre-signed URL grants access to a specific object, not the entire bucket, and the question requires access to the S3 bucket as a whole.

Answer

Create an IAM user for the auditor and attach a policy granting access to the bucket.

Answer

Create a bucket policy that grants access to the auditor's AWS account.

Answer

Generate a pre-signed URL for the bucket.

Question 11

A company uses an IAM policy to allow users to manage their own passwords and access keys. The policy includes a condition that requires multi-factor authentication (MFA) for any sensitive operations. However, users report that they are unable to change their own passwords even when MFA is not required. What is the likely cause?

Accepted Answer

The condition key aws:MultiFactorAuthPresent is set to true, preventing password changes without MFA.. The condition key aws:MultiFactorAuthPresent is set to true, which requires MFA for the action. If this condition is applied to iam:ChangePassword, users without MFA cannot change passwords. Option A is incorrect because aws:MultiFactorAuthAge checks the age of MFA, not presence. Option B is incorrect because missing iam:ChangePassword would prevent all password changes, not just those without MFA. Option C is incorrect because group vs user attachment does not affect condition evaluation; the policy still applies.

Answer

The condition key aws:MultiFactorAuthAge is set incorrectly.

Answer

The policy does not include the iam:ChangePassword action.

Answer

The policy is attached to a group instead of the user.

Question 12

A SysOps administrator needs to ensure that all API calls made to AWS are logged for auditing purposes. Which AWS service should be enabled to capture management events?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls made to AWS for governance, compliance, and auditing. Option B is incorrect because S3 server access logs only capture requests made to S3, not all AWS API calls. Option C is incorrect because VPC Flow Logs capture network traffic, not API calls. Option D is incorrect because CloudWatch Logs can store logs but does not natively capture API calls; it can be used to monitor CloudTrail logs but is not the primary service for capturing management events.

Answer

S3 server access logs

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 13

A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects in the bucket be encrypted at rest using AWS KMS. An administrator notices that some objects are not encrypted. What is the MOST efficient way to enforce encryption for future uploads?

Accepted Answer

Add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms.. Adding a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to aws:kms is the most efficient way to enforce encryption for future uploads. This policy prevents any upload without proper encryption. Option A is incorrect because SCPs (Service Control Policies) limit IAM permissions but do not directly enforce encryption on S3 objects. Option B is incorrect because AWS Config can detect unencrypted objects but does not automatically encrypt them; it is a reactive measure. Option D is incorrect because S3 default encryption can be overridden by the client specifying a different encryption header in the upload request.

Answer

Use an SCP to require KMS encryption for all S3 actions.

Answer

Use AWS Config to detect unencrypted objects and automatically encrypt them.

Answer

Enable S3 default encryption on the bucket with KMS.

Question 14

A SysOps administrator is troubleshooting an issue where an IAM user cannot launch an EC2 instance. The user has a policy that allows ec2:RunInstances. What is the most likely cause of the failure?

Accepted Answer

The user does not have permissions for supporting actions like CreateNetworkInterface.. Launching an EC2 instance requires additional supporting actions beyond ec2:RunInstances, such as ec2:CreateNetworkInterface, ec2:CreateVolume, ec2:DescribeSubnets, etc. Even if the user has RunInstances permission, the request will fail if these supporting actions are not allowed. This is the most common cause of such failures.

Answer

The user is not using multi-factor authentication (MFA).

Answer

The user does not have permission to use the KMS key for encryption.

Answer

The policy is attached to a group instead of the user.

Question 15

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which solution meets this requirement with minimal administrative overhead?

Accepted Answer

Create a new encrypted DB instance and migrate the data.. To encrypt data at rest in Amazon RDS for MySQL, encryption must be enabled at launch time; it cannot be added later. Therefore, the correct approach is to create a new encrypted DB instance and migrate the existing data (Option A). Option B (application-level encryption) adds administrative overhead and is not native to RDS. Option C is incorrect because encryption cannot be enabled on an existing instance; you must create a new one. Option D is incorrect because RDS does not use S3 for its primary storage; it uses Amazon EBS volumes.

Answer

Use application-level encryption to encrypt data before storing it in the DB.

Answer

Enable encryption on the existing DB instance by modifying the DB instance.

Answer

Store the data in an S3 bucket with encryption enabled and use RDS to access it.