SOA-C02 Security and Compliance Practice Test 7 — 15 Questions

Question 1

A company's security policy requires that all Amazon S3 buckets must have server-side encryption enabled. The SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and notify the security team. Which AWS service should be used to detect non-compliant buckets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config is the correct service because it continuously monitors and evaluates the configuration of AWS resources against desired policies. By using an AWS Config managed rule such as `s3-bucket-server-side-encryption-enabled`, you can automatically detect any S3 bucket that lacks server-side encryption and trigger an SNS notification to the security team.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 2

A company wants to enforce that all Amazon EC2 instances launched in the AWS account must have a specific termination protection setting enabled. The SysOps administrator needs to automatically remediate any instances that are launched without termination protection. Which AWS service should be used to achieve this?

Accepted Answer

AWS Config with a custom rule using AWS Lambda to evaluate and enable termination protection.. AWS Config can evaluate resources against desired configurations using managed or custom rules. A custom AWS Config rule can invoke a Lambda function to check if termination protection is enabled on EC2 instances and automatically enable it if missing, providing the required remediation. This approach directly addresses the requirement to enforce termination protection on all launched instances.

Answer

AWS Config with a managed rule ec2-instance-no-public-ip and an SSM Automation remediation.

Answer

Amazon Inspector to scan instances and trigger a remediation action.

Answer

AWS Systems Manager Patch Manager to apply a policy for termination protection.

Question 3

A company requires that all users in an AWS account must authenticate with multi-factor authentication (MFA) before they can perform any actions on Amazon EC2 instances. The SysOps administrator needs to implement this requirement using IAM policies. Which IAM policy condition key should be used to enforce MFA?

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key checks whether the user authenticated using a valid MFA device before making the API request. By setting this condition to `true` in an IAM policy, you can enforce that all actions on EC2 instances require MFA authentication, meeting the company's requirement.

Answer

aws:SourceIp

Answer

aws:RequestedRegion

Answer

iam:PassedToService

Question 4

A company's security policy requires that all Amazon S3 buckets must have server-side encryption enabled. The SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and notify the security team. Which AWS service should be used to detect non-compliant buckets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 bucket policy. An S3 bucket policy is the correct choice because it allows you to explicitly deny or allow access to the S3 bucket based on the source IP address using the `aws:SourceIp` condition key. This policy is attached directly to the bucket and can restrict access to only the corporate office IP range (203.0.113.0/24), regardless of the IAM user or role making the request. It enforces the security requirement at the resource level, which is the most direct and effective method for controlling network-based access to an S3 bucket.

Answer

IAM identity-based policy

Answer

VPC endpoint policy

Answer

AWS Organizations SCP

Question 5

A company requires that all Amazon S3 buckets in its AWS account must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to detect any bucket that does not have KMS encryption enabled and automatically remediate it by enabling encryption. Which AWS service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it can continuously monitor S3 bucket configurations against a desired encryption state using managed rules like 's3-bucket-server-side-encryption-enabled' or custom Lambda rules. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-KMS encryption, enforcing compliance without manual intervention.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Trusted Advisor

Question 6

A company operates a web application behind an Application Load Balancer (ALB). The SysOps administrator needs to block incoming requests from specific geographic locations (countries X and Y) and also enforce a rate limit of 100 requests per IP address per 5-minute window to mitigate DDoS attacks. The solution must be centrally configured and apply to all requests handled by the ALB. Which AWS service should be used to implement these requirements?

Accepted Answer

AWS WAF. AWS WAF is the correct service because it provides both geographic (geo-match) blocking and rate-based rules that can be associated directly with an Application Load Balancer. Geo-match conditions allow you to block requests from specific countries (X and Y), while rate-based rules can limit requests to 100 per 5-minute window per source IP. This solution is centrally configured at the ALB level, applying to all incoming requests without requiring additional infrastructure.

Answer

Amazon CloudFront geo restriction

Answer

AWS Shield Advanced

Answer

Security Groups

Question 7

A company requires that all Amazon EC2 instances launched in its AWS account must have termination protection enabled. The SysOps administrator needs to automatically remediate any instance launched without termination protection. The solution should use AWS managed services without custom scripts. Which AWS service should be used?

Accepted Answer

Configure AWS Config with a managed rule 'ec2-termination-protection-check' and set an auto-remediation action using an AWS Systems Manager Automation document that enables termination protection on the instance.. AWS Config's managed rule 'ec2-termination-protection-check' can detect instances without termination protection, and you can attach an auto-remediation action using an AWS Systems Manager Automation document (e.g., AWS-EnableTerminationProtection) to automatically enable termination protection on noncompliant instances. This solution uses only AWS managed services and requires no custom scripts, meeting the company's requirements.

Answer

Use Amazon EC2 Auto Scaling to automatically apply termination protection to all launched instances.

Answer

Enable AWS Trusted Advisor to send notifications when instances lack termination protection, and have administrators manually fix them.

Answer

Create an IAM policy that denies the RunInstances action unless termination protection is enabled.

Question 8

A SysOps administrator needs to ensure that all Amazon S3 buckets in an AWS account are configured with server-side encryption using AWS KMS (SSE-KMS). The administrator wants to automatically detect any S3 buckets that are not compliant and remediate them by enabling SSE-KMS. Which AWS service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled) that can continuously evaluate S3 buckets for compliance with SSE-KMS. When a non-compliant bucket is detected, AWS Config can trigger an AWS Systems Manager Automation document or a custom remediation action (via AWS Config Rules remediation) to automatically enable SSE-KMS on the bucket, ensuring automated enforcement without manual intervention.

Answer

AWS Trusted Advisor

Answer

AWS Service Catalog

Answer

AWS CloudFormation

Question 9

A company's security policy requires that all Amazon S3 buckets must have server-side encryption enabled. The SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and notify the security team. Which AWS service should be used to detect non-compliant buckets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key allows the administrator to enforce MFA authentication by checking whether the user authenticated with a valid MFA device before allowing the action. When set to `true`, the policy denies access to EC2 actions unless the user has completed MFA. This directly satisfies the security policy requirement.

Answer

aws:SourceIp

Answer

iam:PassedToService

Answer

ec2:SourceInstanceARN

Question 10

A company's security policy requires that all Amazon S3 buckets must have server-side encryption enabled. The SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and notify the security team. Which AWS service should be used to detect non-compliant buckets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config is the correct service because it provides managed rules (e.g., s3-bucket-server-side-encryption-enabled) that can continuously evaluate S3 bucket configurations against the security policy. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action via Systems Manager Automation to enable SSE-S3, enforcing compliance without manual intervention.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

Amazon Macie

Question 11

A company manages multiple AWS accounts under AWS Organizations. The security team requires that all Amazon S3 buckets in the organization must be encrypted using AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect any bucket that is not compliant and remediate it by enabling SSE-KMS. Which AWS feature or service should be used to implement this automated compliance enforcement?

Accepted Answer

AWS Config with the s3-bucket-server-side-encryption-enabled managed rule and automatic remediation using an AWS Systems Manager Automation document.. AWS Config's `s3-bucket-server-side-encryption-enabled` managed rule can evaluate S3 buckets for encryption compliance. When a non-compliant bucket is detected, AWS Config can trigger automatic remediation via an AWS Systems Manager Automation document that applies SSE-KMS encryption to the bucket. This provides a fully automated, policy-driven enforcement mechanism without manual intervention.

Answer

AWS CloudTrail to log bucket creation events and trigger an AWS Lambda function that applies SSE-KMS.

Answer

Amazon Inspector to scan S3 buckets for encryption compliance and automatically apply SSE-KMS.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications but not auto-remediate.

Question 12

A company's security team requires that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. The SysOps administrator needs to create an IAM policy that denies all console actions if the user has not authenticated with MFA. Which IAM condition key should the administrator use?

Accepted Answer

aws:MultiFactorAuthPresent. The `aws:MultiFactorAuthPresent` condition key evaluates to `true` when the user has authenticated using MFA. By using this key in a `Deny` statement, the policy can block all console actions unless MFA is present, enforcing the security team's requirement.

Answer

aws:SourceIp

Answer

iam:PassedToService

Answer

aws:RequestedRegion

Question 13

A company uses AWS Organizations and has multiple accounts. The security team requires that all Amazon S3 buckets across all accounts must be encrypted at rest with AWS KMS (SSE-KMS). The SysOps administrator needs to automatically detect non-compliant buckets and remediate them by enabling SSE-KMS. The solution must work across all existing and future accounts. Which AWS service should be used?

Accepted Answer

AWS Config with a managed rule and an automatic remediation action using AWS Systems Manager Automation.. AWS Config with the managed rule 's3-bucket-server-side-encryption-enabled' can evaluate all S3 buckets across accounts in an AWS Organization. When a non-compliant bucket is detected, an automatic remediation action using an AWS Systems Manager Automation document (e.g., 'AWS-EnableS3BucketEncryption') can enable SSE-KMS without manual intervention. This solution scales to existing and future accounts because AWS Config can be set up as an aggregator across the organization, and remediation actions apply automatically as new accounts are added.

Answer

AWS CloudTrail with a metric filter and Amazon CloudWatch alarm to trigger a Lambda function.

Answer

AWS Trusted Advisor to check S3 bucket encryption and send notifications.

Answer

Amazon Macie to discover sensitive data and then manually encrypt buckets.

Question 14

Match each AWS service with its primary security compliance function. (Drag each service to its correct function.) (Choose 4.)

Accepted Answer

AWS CloudTrail -> Detect unauthorized API calls. AWS CloudTrail is the service that records API activity in your AWS account, including both management and data events. By enabling CloudTrail, you can detect unauthorized API calls by analyzing the recorded events for actions that were not initiated by authorized users or services, such as an IAM user making a call from an unexpected IP address or using an unknown user agent.

Question 15

A company's security policy requires that all Amazon S3 buckets must have server-side encryption enabled. The SysOps administrator needs to automatically detect any bucket that does not have encryption enabled and notify the security team. Which AWS service should be used to detect non-compliant buckets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config with a managed rule and AWS Lambda for automatic remediation.. AWS Config with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) can continuously evaluate S3 buckets for compliance with the encryption policy. When a non-compliant bucket is detected, AWS Config can automatically invoke an AWS Lambda function to remediate the issue, such as enabling encryption with a customer managed KMS key. This combination provides automated detection and remediation using infrastructure as code, as the Config rule and Lambda function can be defined in AWS CloudFormation or similar IaC tools.

Answer

AWS CloudTrail and Amazon GuardDuty.

Answer

Amazon Inspector and AWS Systems Manager.

Answer

Amazon Macie and AWS CloudFormation.