SOA-C02 Security and Compliance Practice Test 8 — 15 Questions

Question 1

A company uses an IAM policy that allows s3:GetObject for a specific bucket. However, an IAM user is getting an Access Denied error when trying to download an object. The bucket policy also allows s3:GetObject for the user's account. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bucket policy has a Deny statement that applies to the user.. The most likely cause because if the bucket policy has a Deny statement that applies to the user, that explicit denial overrides any allow from the IAM policy or the bucket policy. Option A is incorrect because s3:GetObjectVersion is not required to download the current version; s3:GetObject is sufficient. Option C is incorrect because there is no indication that the object is encrypted with KMS, and even if it were, the error would be different (e.g., 'AccessDenied' due to missing KMS permissions, but the scenario explicitly says Access Denied from S3). Option D is incorrect because SCPs apply to the entire account, but the question states that both IAM and bucket policies allow access, so an SCP denial would be possible, but it is not the most likely cause given the explicit allow statements and the fact that a bucket-level Deny is more direct.

Answer

The IAM policy does not include the s3:GetObjectVersion action.

Answer

The object is encrypted with a customer-managed KMS key, and the user does not have kms:Decrypt permissions.

Answer

The user's account is part of an AWS Organization with an SCP that denies s3:GetObject.

Question 2

A SysOps administrator needs to generate a report of all IAM users and their last activity. Which AWS service can provide this information?

Accepted Answer

IAM Credential Report. IAM Credential Report provides a consolidated report of all IAM users and their last activity, including password last used and access key last rotated. Option A is incorrect because AWS Config tracks resource configuration changes, not user activity. Option C is incorrect because AWS Trusted Advisor provides cost optimization and security recommendations, not detailed user activity reports. Option D is incorrect because AWS CloudTrail logs API calls but does not generate a summarized report of user credentials.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 3

A company wants to ensure that an EC2 instance can access an S3 bucket without storing AWS credentials on the instance. What should the SysOps administrator do?

Accepted Answer

Create an IAM role with permissions to the S3 bucket and attach it to the EC2 instance profile.. An IAM role can be attached to an EC2 instance via an instance profile, granting temporary security credentials that allow the instance to access the S3 bucket without storing long-term credentials on the instance. Option B is incorrect because an S3 bucket policy cannot be attached to an instance; it is attached to the S3 bucket itself, and using the instance's public IP is not a secure or recommended method. Option C is incorrect because storing access keys on the instance violates the requirement of not storing credentials. Option D is incorrect because while AWS STS can generate temporary credentials, storing them in instance user data is not secure and does not eliminate credential storage on the instance.

Answer

Attach an S3 bucket policy that grants access to the EC2 instance's public IP address.

Answer

Generate access keys for an IAM user and store them on the instance.

Answer

Use AWS STS to generate temporary credentials and store them in the instance's user data.

Question 4

An IAM user has the policy shown in the exhibit. The user is trying to download an object from example-bucket from an IP address of 192.0.2.50. However, the request is denied. What is the most likely reason?

Accepted Answer

The bucket has a bucket policy that denies access from the user's IP address.. The bucket policy explicitly denies the request from IP 192.0.2.50, overriding any IAM policy that allows the action. Option A is incorrect because aws:SourceIp is a valid condition key. Option C is incorrect because the resource ARN 'arn:aws:s3:::example-bucket/*' is appropriate for GetObject on objects. Option D is incorrect because the condition key aws:SourceIp requires the IpAddress operator, not StringEquals.

Answer

The condition key aws:SourceIp should be aws:SourceIpAddress.

Answer

The resource ARN does not include the bucket itself.

Answer

The condition syntax is incorrect because it should use StringEquals.

Question 5

A company wants to ensure that data in transit between an EC2 instance and an RDS database is encrypted. Which TWO actions should the SysOps administrator take? (Choose TWO.)

Accepted Answer

Enable SSL/TLS for the RDS DB instance.. To encrypt data in transit between an EC2 instance and an RDS database, two actions are required: enabling SSL/TLS on the RDS DB instance (option B) and configuring the application to use SSL/TLS when connecting to the database (option E). The database must accept SSL connections, and the client must initiate them. Option A (VPC peering) does not encrypt traffic; it only provides network connectivity. Option C (VPN) adds encryption but is unnecessary when SSL/TLS is used within the same VPC. Option D (encryption at rest) protects data stored on disk, not data in transit.

Answer

Use VPC peering to connect the EC2 instance and RDS database.

Answer

Set up a VPN connection between the EC2 instance and the RDS database.

Answer

Enable encryption at rest for the RDS DB instance.

Question 6

A company has an AWS account with multiple IAM users. The security team wants to enforce that all users use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should the SysOps administrator take? (Choose THREE.)

Accepted Answer

Enable MFA for each IAM user in the AWS Management Console.. To enforce MFA for all IAM users, the administrator must enable MFA for each user (B), create an IAM policy that denies console access unless MFA is present (C), and educate users on how to set up and use MFA devices (E). Option A is incorrect because service control policies (SCPs) are used in AWS Organizations and do not directly enforce MFA on IAM users in a single account. Option D is incorrect because AWS CloudTrail is a monitoring service and does not enforce MFA requirements.

Answer

Attach a service control policy (SCP) to the account to require MFA.

Answer

Use AWS CloudTrail to monitor user logins and disable accounts without MFA.

Question 7

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive data in an S3 bucket. The security team has mandated that all data in transit to the S3 bucket must be encrypted using TLS. The SysOps administrator configured the application to use HTTPS endpoints for S3. However, a security audit reveals that some requests to S3 are still being sent over HTTP. The administrator checks the VPC Flow Logs and sees that the EC2 instances are communicating with the S3 bucket via a VPC endpoint. The company also uses an S3 bucket policy that allows access only from the VPC endpoint. What is the most likely reason that some requests are sent over HTTP?

Accepted Answer

The application is not configured to use HTTPS for all S3 requests.. The VPC endpoint for S3 does not automatically encrypt traffic; encryption is handled at the application level. The application must be configured to use HTTPS for all S3 requests. Even though the administrator configured the application to use HTTPS endpoints, some requests may still be sent over HTTP if the application has fallback logic or uses an SDK that defaults to HTTP in certain cases. Option A is incorrect because the VPC endpoint itself does not encrypt traffic; encryption is an application-layer function. Option B is incorrect because VPC endpoints are not configured for HTTP or HTTPS; they use AWS API calls which can be made over either protocol depending on the client. Option C is incorrect because the S3 bucket policy does not require HTTPS; it only restricts access to the VPC endpoint, not the protocol.

Answer

The VPC endpoint is not encrypting traffic between the instances and the endpoint.

Answer

The VPC endpoint is configured for HTTP instead of HTTPS.

Answer

The S3 bucket policy does not require HTTPS for requests.

Question 8

A company has a single AWS account with multiple IAM users. The security team wants to ensure that no IAM user can create or modify VPC resources. The SysOps administrator creates a managed policy that denies ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute, and similar actions. The policy is attached to all IAM users via a group. However, after a week, a user reports that they were able to create a VPC. The administrator checks CloudTrail and confirms that the user created the VPC. What is the most likely cause?

Accepted Answer

The user created the VPC using AWS CloudFormation with a service role that had full EC2 access.. The most likely cause is that the user created the VPC using AWS CloudFormation with a service role that had full EC2 access (including ec2:CreateVpc). IAM policies applied to a user do not affect actions taken by AWS services like CloudFormation when a service role is used, because the service role itself grants permissions. Even though the user's group policy denies VPC creation, the CloudFormation service role bypasses the user's IAM policies. This is a known pitfall: service roles can allow users to perform actions that their own IAM policies deny, if they have permission to pass the role.

Answer

The user used the AWS Management Console, which does not enforce IAM policies.

Answer

The user had an inline policy that allowed ec2:CreateVpc, overriding the group policy.

Answer

The policy was attached to the user's group, but the user was not a member of that group.

Question 9

A company is using AWS Organizations with SCPs to restrict access to services. The security team wants to ensure that no IAM user can create access keys, but the SCP is not working as expected. What is the most likely cause?

Accepted Answer

The SCP is applied to a member account, but the IAM user is in the management account.. SCPs apply only to member accounts, not the management account. If the IAM user is in the management account, the SCP cannot restrict their actions. Option A is incorrect because SCPs are inherited from the root OU to all member accounts, so the SCP would be applied if the account were a member account; the issue is that the user is in the management account. Option C is wrong because SCPs take effect almost immediately, not 24 hours. Option D is wrong because SCPs apply to all principals (including IAM users) in member accounts, not just root users.

Answer

The SCP is applied to the root OU but not inherited by the account.

Answer

The SCP has a Deny effect, but it takes 24 hours to apply.

Answer

The SCP only applies to root users, not IAM users.

Question 10

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot access an S3 bucket using an instance profile. The instance profile has an IAM role with a policy that allows s3:GetObject on the bucket. The S3 bucket policy has a Deny for all principals except a specific service role. What is the most likely reason for the access failure?

Accepted Answer

The S3 bucket policy Deny overrides the IAM role permissions.. An explicit Deny in an S3 bucket policy overrides any Allow permissions granted by IAM policies, including those from an instance profile role. In this scenario, the bucket policy denies access to all principals except a specific service role, so even though the IAM role attached to the EC2 instance allows s3:GetObject, the Deny takes precedence, causing access failure. Option A is incorrect because the issue is not about the trust policy; if the instance profile is attached, EC2 can assume the role. Option B is incorrect because the instance profile attachment is not the likely cause; the Deny in the bucket policy would block access regardless. Option C is incorrect because a VPC endpoint is not required for S3 access and would not override the bucket policy Deny.

Answer

The IAM role trust policy does not allow EC2 to assume the role.

Answer

The instance profile is not correctly attached to the EC2 instance.

Answer

The S3 bucket requires a VPC endpoint.

Question 11

A company requires that all data stored in Amazon S3 be encrypted at rest. Which S3 feature should be enabled to meet this requirement without changing the application code?

Accepted Answer

Enable default encryption on the S3 bucket.. Enabling default encryption on the S3 bucket automatically encrypts all new objects at rest without requiring any application code changes. Option A (using a bucket policy to deny unencrypted uploads) can enforce encryption but does not encrypt the objects; it requires the application to include encryption headers, which would require code changes. Option C (S3 Object Lock) is a feature for preventing object deletion or overwrites, not for encryption. Option D (client-side encryption) requires modifying the application to encrypt data before upload, which does not meet the requirement of no code changes.

Answer

Use an S3 bucket policy to deny unencrypted uploads.

Answer

Enable S3 Object Lock.

Answer

Use client-side encryption.

Question 12

A company is using AWS CloudTrail to log all API calls. The security team wants to ensure that logs are tamper-proof and stored securely. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Encrypt the CloudTrail log files with SSE-KMS.. Encrypting CloudTrail log files with SSE-KMS ensures data is encrypted at rest, providing secure storage. Option E is correct because enabling CloudTrail log file validation creates digest files that can be used to verify the integrity of log files, ensuring they are tamper-proof. Option A is incorrect because writing logs to a different AWS account does not inherently prevent tampering. Option C is incorrect because MFA Delete on the S3 bucket adds an extra layer of protection for delete operations but does not directly address tamper-proofing or encryption. Option D is incorrect because S3 server access logs record requests made to the bucket but do not secure the CloudTrail logs themselves.

Answer

Write logs to a different AWS account.

Answer

Enable MFA Delete on the S3 bucket.

Answer

Enable S3 server access logs.

Question 13

A company wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which TWO steps should be taken? (Choose two.)

Accepted Answer

Create an IAM policy that denies access without MFA.. To enforce MFA for AWS Management Console access, two steps are required: (1) Create an IAM policy that explicitly denies all actions when MFA is not present, and attach it to users or groups (Option B). (2) Enable MFA on each IAM user's account via the console (Option C). Option A is incorrect because CloudTrail only logs API calls, it does not enforce MFA. Option D is incorrect because MFA is configured per user, not at the account level. Option E is incorrect because modifying a role trust policy controls which principals can assume the role, not direct console access for IAM users.

Answer

Use AWS CloudTrail to monitor MFA usage.

Answer

Enable MFA at the AWS account level.

Answer

Modify the IAM role trust policy to require MFA.

Question 14

A company needs to audit all changes to AWS resources. Which THREE AWS services should be used together to achieve this? (Choose three.)

Accepted Answer

AWS CloudTrail. The correct combination of services to audit all changes to AWS resources is AWS CloudTrail (B), Amazon CloudWatch Events (C), and AWS Config (E). AWS CloudTrail records API calls made to the AWS environment, providing an audit trail of user activity and changes. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture events from CloudTrail and other sources to trigger automated responses or notifications. AWS Config continuously monitors and records configuration changes to AWS resources, allowing you to track resource inventory and changes over time. Amazon Inspector (A) is incorrect because it is a vulnerability management service that assesses applications for security vulnerabilities, not for auditing changes. AWS Trusted Advisor (D) is incorrect because it provides recommendations based on AWS best practices, but does not record or audit changes.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Question 15

A SysOps administrator applies the IAM policy shown in the exhibit to an IAM user. The user tries to upload an object to the S3 bucket without specifying encryption. What will happen?

Accepted Answer

The upload fails with an Access Denied error.. The IAM policy includes a condition that requires the `s3:x-amz-server-side-encryption` header to be present and set to a valid encryption algorithm (e.g., SSE-S3 or SSE-KMS). Since the user does not specify any encryption in the upload request, the condition is not met, and the `s3:PutObject` action is denied. Therefore, the upload fails with an Access Denied error. Option C is correct. Options A, B, and D are incorrect because the policy denies unencrypted uploads, regardless of default bucket settings.

Answer

The upload succeeds without encryption.

Answer

The upload succeeds with SSE-KMS encryption.

Answer

The upload succeeds with default encryption.