SOA-C02 Security and Compliance Practice Test 7 — 15 Questions

Question 1

A SysOps administrator needs to ensure that data in an S3 bucket is encrypted at rest. The bucket already has server-side encryption with S3 managed keys (SSE-S3) enabled. Which additional step is required to enforce encryption for all objects?

Accepted Answer

Add a bucket policy that denies PutObject without encryption.. Option B is correct because a bucket policy can deny PutObject requests without the x-amz-server-side-encryption header. Option A is wrong because SSE-S3 is already enabled. Option C is wrong because CloudTrail does not enforce encryption. Option D is wrong because versioning does not enforce encryption.

Answer

Enable CloudTrail to log unencrypted uploads.

Answer

Enable default encryption on the bucket.

Answer

Enable versioning on the bucket.

Question 2

A company has a legacy application that requires access to an S3 bucket using an IAM user's access keys. The security team wants to rotate the access keys every 90 days automatically. What is the MOST efficient way to achieve this?

Accepted Answer

Store the access keys in AWS Secrets Manager and use automatic rotation.. Option D is correct because AWS Secrets Manager can automatically rotate IAM user access keys on a schedule. Option A is wrong because manual rotation is not automatic. Option B is wrong because Lambda can be used but requires custom code. Option C is wrong because IAM doesn't natively rotate keys automatically.

Answer

Use AWS Lambda with a scheduled CloudWatch Events rule to rotate the keys.

Answer

Create a script that runs on an EC2 instance using cron to rotate the keys.

Answer

Enable IAM access key rotation in the IAM console.

Question 3

An administrator notices that an EC2 instance has been compromised. The instance is part of an Auto Scaling group. What should the administrator do FIRST to contain the incident?

Accepted Answer

Detach the instance from the Auto Scaling group and apply a security group that denies all traffic.. Option A is correct because detaching the instance from the ASG and applying a deny-all security group isolates it. Option B is wrong because termination may lose evidence. Option C is wrong because changing the launch configuration doesn't affect running instances. Option D is wrong because termination is not immediate containment.

Answer

Update the Auto Scaling group's launch configuration to use a different AMI.

Answer

Terminate the instance immediately.

Answer

Delete the Auto Scaling group.

Question 4

A company wants to allow an external auditor to read objects in a specific S3 bucket for 30 days. The auditor does not have an AWS account. Which method should be used?

Accepted Answer

Generate presigned URLs for the objects.. Option C is correct because presigned URLs grant temporary access to specific objects without requiring AWS credentials. Option A is wrong because bucket policies require the auditor to have AWS credentials. Option B is wrong because IAM users require credentials. Option D is wrong because CloudFront does not provide temporary access by itself.

Answer

Create a bucket policy that allows the auditor's IP address.

Answer

Create an IAM user for the auditor and share the credentials.

Answer

Use CloudFront signed URLs.

Question 5

An organization wants to enforce that all IAM users have multi-factor authentication (MFA) enabled before they can perform any action except changing their own password. Which IAM policy element is MOST appropriate?

Accepted Answer

Use a Condition element with 'aws:MultiFactorAuthPresent' set to 'true' in a Deny policy.. Option A is correct because a Condition with 'aws:MultiFactorAuthPresent':'true' can be used to require MFA. Option B is wrong because Resource doesn't enforce MFA. Option C is wrong because Action specifies actions. Option D is wrong because NotAction is not for MFA enforcement.

Answer

Use an Action element to allow only MFA actions.

Answer

Use a NotAction element to allow password change without MFA.

Answer

Use a Resource element to limit access to MFA-enabled users.

Question 6

A company stores sensitive data in an RDS database. Which AWS service should be used to encrypt the database at rest?

Accepted Answer

AWS Key Management Service (KMS). Option C is correct because AWS KMS provides encryption keys for RDS encryption. Option A is wrong because ACM provides SSL/TLS certificates. Option B is wrong because CloudHSM is a hardware security module but not the primary service. Option D is wrong because IAM manages identities.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM

Question 7

Which TWO actions should a SysOps administrator take to secure an AWS account root user? (Choose two.)

Accepted Answer

Enable multi-factor authentication (MFA) for the root user.. Option A is correct because MFA on root user is a best practice. Option C is correct because access keys should not be created for root user; instead use IAM users. Option B is wrong because CloudTrail is not specific to root user. Option D is wrong because root user cannot be deleted. Option E is wrong because SCPs do not apply to root user in management account.

Answer

Delete the root user after creating an admin IAM user.

Answer

Apply a service control policy (SCP) to restrict the root user.

Answer

Enable CloudTrail to monitor root user activity.

Question 8

Which THREE are valid methods to control access to an S3 bucket? (Choose three.)

Accepted Answer

Access control lists (ACLs). Option A is correct because bucket policies are a method. Option B is correct because IAM policies can grant access to S3. Option D is correct because ACLs are a legacy method. Option C is wrong because VPC Flow Logs are not access control. Option E is wrong because CloudWatch Logs are not access control.

Answer

VPC Flow Logs

Answer

CloudWatch Logs

Question 9

Which TWO services can be used to centrally manage cryptographic keys for AWS services? (Choose two.)

Accepted Answer

AWS CloudHSM. Option A is correct because AWS KMS is the managed key service. Option C is correct because AWS CloudHSM provides hardware-based key management. Option B is wrong because ACM manages certificates, not keys. Option D is wrong because IAM manages identities. Option E is wrong because Secrets Manager manages secrets, not cryptographic keys.

Answer

AWS Certificate Manager (ACM)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Secrets Manager

Question 10

Refer to the exhibit. An IAM policy is attached to a user. Which statement about the user's access is correct?

Accepted Answer

The user can get objects only over HTTPS.. Option B is correct because the GetObject action requires HTTPS (SecureTransport true). Option A is wrong because ListBucket does not have the condition so HTTP is allowed. Option C is wrong because the condition applies to GetObject only. Option D is wrong because the policy allows ListBucket with HTTP.

Answer

The user can get objects over HTTP.

Answer

The user can list objects in the bucket over HTTP.

Answer

The user can list objects only over HTTPS.

Question 11

Refer to the exhibit. A SysOps administrator runs the AWS CLI command to check the event selectors for a CloudTrail trail. What does the output indicate?

Accepted Answer

The trail logs all management events.. Option C is correct because the output shows IncludeManagementEvents true and ReadWriteType All, so all management events are logged. Option A is wrong because data events are not logged (DataResources empty). Option B is wrong because read and write events are both logged. Option D is wrong because data events are not logged.

Answer

The trail logs both management and data events.

Answer

The trail logs all data events.

Answer

The trail logs only write management events.

Question 12

Refer to the exhibit. A SysOps administrator runs the command to list running EC2 instances. What is the purpose of the '--query' parameter?

Accepted Answer

It filters the output to show only specified fields.. Option D is correct because the '--query' parameter filters and formats the output using JMESPath. Option A is wrong because it does not filter before API call. Option B is wrong because it only formats output, not saves to a file. Option C is wrong because it does not change the API call.

Answer

It filters the results on the server side.

Answer

It limits the API call to only running instances.

Answer

It saves the output to a file.

Question 13

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM users in any member account can create access keys for themselves. What is the MOST efficient way to enforce this policy across all accounts?

Accepted Answer

Create an SCP that denies the iam:CreateAccessKey action and attach it to the root organizational unit.. A service control policy (SCP) can be applied at the root or to specific OUs to deny IAM actions across all member accounts. Option A is correct because it centrally restricts the action. Option B is wrong because it only works for the master account. Option C is wrong because it requires individual account configuration. Option D is wrong because Trusted Advisor only provides recommendations, not enforcement.

Answer

Apply an IAM policy to the master account's root user that denies access key creation.

Answer

Enable AWS Trusted Advisor security checks and follow the recommendations.

Answer

Use AWS Config to detect access key creation and automatically delete the keys using a Lambda function.

Question 14

A SysOps administrator needs to share an encrypted AMI with a different AWS account. The AMI uses an AWS KMS key (customer managed key) for EBS encryption. What must be done to allow the target account to launch EC2 instances from the AMI?

Accepted Answer

Modify the AMI launch permissions and add the target account as a principal in the KMS key policy with kms:Decrypt permission.. To share an encrypted AMI with a different account, both the AMI permissions and the KMS key permissions must be updated. Option C is correct because it grants the required permissions. Option A is wrong because modifying launch permissions is not enough; KMS key permissions are also needed. Option B is wrong because sharing the snapshot separately does not grant KMS access. Option D is wrong because re-encrypting with a new key is unnecessary if permissions are properly set.

Answer

Share the underlying EBS snapshot with the target account.

Answer

Re-encrypt the AMI using a new KMS key that is shared with the target account.

Answer

Modify the AMI launch permissions to include the target account.

Question 15

A company's security team notices that an IAM user has been generating multiple access keys and deleting them within a short period. The SysOps administrator needs to detect and alert on this behavior. Which solution is the MOST effective?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers on iam:CreateAccessKey events and sends a notification to an SNS topic.. Option B is correct because AWS CloudTrail logs all IAM API calls, and CloudWatch Events can trigger on the CreateAccessKey event. Option A is wrong because IAM Access Analyzer analyzes resource policies, not user activity. Option C is wrong because AWS Config evaluates resource compliance, not API call patterns. Option D is wrong because Trusted Advisor does not monitor user behavior.

Answer

Enable AWS Trusted Advisor security checks and review the report weekly.

Answer

Enable IAM Access Analyzer to analyze user activity and send alerts.

Answer

Use AWS Config to track IAM user configuration changes and trigger an alert when an access key is created.