SOA-C02 Security and Compliance Practice Test 8 — 15 Questions

Question 1

An organization requires that all Amazon S3 buckets be encrypted with AES-256 server-side encryption. A SysOps administrator needs to enforce this policy across the entire AWS account. Which action should be taken?

Accepted Answer

Apply an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header set to AES256.. Option D is correct because a bucket policy that denies PutObject without the x-amz-server-side-encryption header set to AES256 will enforce encryption. Option A is wrong because default encryption does not prevent objects from being uploaded without encryption header. Option B is wrong because CloudTrail logs but does not enforce. Option C is wrong because S3 Inventory does not enforce.

Answer

Enable default encryption on all existing and future S3 buckets.

Answer

Use AWS CloudTrail to monitor uploads without encryption and alert the administrator.

Answer

Use S3 Inventory to list unencrypted objects and remediate them manually.

Question 2

A SysOps administrator needs to provide a developer from another AWS account access to an S3 bucket in the administrator's account. The developer must be able to list objects and get objects from the bucket. The administrator does NOT want to share AWS access keys. Which solution meets these requirements?

Accepted Answer

Attach a bucket policy to the S3 bucket that grants s3:ListBucket and s3:GetObject to the developer's IAM user ARN.. Option C is correct because an S3 bucket policy with a Principal ARN for the developer's IAM user grants cross-account access without sharing keys. Option A is wrong because sharing access keys is not recommended. Option B is wrong because pre-signed URLs are temporary and must be generated per object. Option D is wrong because granting the developer's root user is overly permissive and not secure.

Answer

Create an IAM user in the administrator's account and share the access key and secret key with the developer.

Answer

Generate pre-signed URLs for all objects and share them with the developer.

Answer

Grant the developer's AWS account root user access to the bucket using a bucket policy.

Question 3

A company uses IAM roles to grant EC2 instances access to S3 buckets. After a recent security audit, the SysOps administrator must ensure that only instances with a specific tag (Environment=Production) can assume the role. How can this be achieved?

Accepted Answer

Add a condition in the role's trust policy that checks for the instance's tag using the aws:ResourceTag condition key.. Option D is correct because IAM role trust policies can use the aws:ResourceTag condition key to restrict which EC2 instances (based on their tags) can assume the role. Option A is wrong because tags are not automatically included in the session; the trust policy must explicitly check tags. Option B is wrong because SCPs apply to accounts, not instances. Option C is wrong because instance profiles cannot be modified to check tags.

Answer

Create a new IAM role for each instance and attach the tag.

Answer

Use a service control policy (SCP) to deny the ec2:AssumeRole action for instances without the required tag.

Answer

Modify the instance profile to include the tag requirement.

Question 4

A SysOps administrator is configuring a new AWS account and wants to set up a secure password policy for IAM users. The policy must require at least 12 characters, one uppercase letter, one number, and must prevent password reuse. Where should this policy be configured?

Accepted Answer

In the IAM console under Account settings, set the password policy.. Option A is correct because AWS IAM password policies are configured at the account level in the IAM console or via the update-account-password-policy API. Option B is wrong because there is no password policy for the root user. Option C is wrong because SCPs can restrict IAM actions but do not set password policy. Option D is wrong because IAM roles do not have passwords.

Answer

Apply a service control policy (SCP) that enforces password complexity.

Answer

Set a password policy on the AWS account root user.

Answer

Create an IAM role with a password policy attached.

Question 5

A company wants to provide temporary credentials to an application running on an on-premises server so it can access AWS resources. The credentials must be rotated automatically. Which IAM feature should be used?

Accepted Answer

Use IAM Roles Anywhere with a certificate authority to issue temporary credentials.. Option C is correct because IAM Roles Anywhere allows workloads outside of AWS to assume an IAM role and obtain temporary credentials using X.509 certificates. Option A is wrong because IAM users have long-term credentials. Option B is wrong because instance profiles are for EC2 instances only. Option D is wrong because federation with SAML is for user identities, not machine identities.

Answer

Use an EC2 instance profile and attach it to the on-premises server.

Answer

Configure a SAML 2.0 identity provider and federate the application.

Answer

Create an IAM user with programmatic access and share the access key.

Question 6

An organization uses AWS KMS to encrypt data in S3. A SysOps administrator needs to ensure that KMS keys cannot be deleted accidentally. What is the MOST effective way to protect against accidental key deletion?

Accepted Answer

Set a high waiting period (e.g., 30 days) for key deletion and require multi-factor authentication (MFA) for the deletion.. Option B is correct because enabling key deletion in KMS requires a waiting period (customizable) during which the key is disabled and can be canceled. Option A is wrong because disabling the key does not prevent deletion; the key can still be scheduled for deletion. Option C is wrong because SCPs cannot prevent key deletion if the key is in the same account. Option D is wrong because a backup of the key is not possible; KMS keys are not exportable.

Answer

Disable the KMS key so it cannot be used but can still be deleted.

Answer

Create a backup of the KMS key in another AWS Region.

Answer

Use a service control policy (SCP) to deny the kms:ScheduleKeyDeletion action.

Question 7

A company has an S3 bucket that stores sensitive data. The security team requires that all data be encrypted at rest and that all access be logged. Which TWO actions should the SysOps administrator take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable default encryption on the S3 bucket.. Option A is correct: Enabling default encryption ensures objects are encrypted with SSE-S3 or SSE-KMS. Option D is correct: Enabling S3 server access logs logs all requests. Option B is wrong because S3 Replication does not provide encryption. Option C is wrong because S3 Transfer Acceleration is about speed, not security. Option E is wrong because S3 Object Lock is for write-once-read-many (WORM) protection, not encryption or logging.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable S3 Replication to replicate objects to another bucket.

Answer

Enable S3 Object Lock.

Question 8

A SysOps administrator is designing a solution to manage secrets (e.g., database credentials) for a multi-tier application running on EC2 instances. The solution must rotate secrets automatically and provide fine-grained access control. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. Option A is correct: AWS Secrets Manager can rotate secrets automatically. Option D is correct: IAM roles for EC2 provide fine-grained access control without storing credentials on the instance. Option B is wrong because SSM Parameter Store can store secrets but does not support automatic rotation. Option C is wrong because KMS encrypts but does not rotate. Option E is wrong because CloudHSM is a hardware security module, not a secret management service.

Answer

AWS KMS

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 9

A company wants to audit all API calls made in their AWS account for security analysis. They need to record both management events and data events. Which THREE steps should be taken to set up comprehensive logging? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail to record data events for S3 and Lambda.. Option A is correct: CloudTrail records management events by default. Option B is correct: To capture data events, you must enable them in the trail. Option C is correct: Storing logs in an S3 bucket is standard. Option D is wrong because CloudWatch Logs is for log monitoring, not recording. Option E is wrong because VPC Flow Logs capture network traffic, not API calls.

Answer

Enable VPC Flow Logs to capture API call metadata.

Answer

Send the log files to Amazon CloudWatch Logs for real-time analysis.

Question 10

A company wants to securely store database credentials used by an application running on Amazon EC2. Which AWS service should be used to rotate and manage access to these secrets?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager provides automatic rotation of secrets, while Systems Manager Parameter Store does not offer native rotation. KMS is for encryption keys, not secrets. IAM is for access management, not secret storage.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 11

A SysOps administrator is troubleshooting an issue where an IAM user can launch EC2 instances but cannot terminate them. The user's permissions are based on an IAM group policy. Which action should the administrator take to resolve this?

Accepted Answer

Review and modify the IAM group policy to include ec2:TerminateInstances action. The administrator should review the group policy to ensure it includes ec2:TerminateInstances. The issue is likely a missing action in the policy, not a service control policy (SCP) or session policy issue, and simply adding the user to a new group won't fix the underlying policy gap.

Answer

Attach a managed policy that includes ec2:TerminateInstances directly to the user

Answer

Add the user to a different IAM group that has the required permissions

Answer

Check the user's permissions boundary for any restrictions

Question 12

A company has an S3 bucket that stores sensitive customer data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS with a specific customer managed key. Which bucket policy condition should be used to enforce this?

Accepted Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms", "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}. The condition 's3:x-amz-server-side-encryption':'aws:kms' ensures KMS encryption is used, and 's3:x-amz-server-side-encryption-aws-kms-key-id' with the specific key ARN ensures only that key is used. Option A enforces KMS encryption but does not specify the key; Option B allows any KMS key; Option C is incorrect because it uses 'Null' condition incorrectly; Option D correctly enforces both encryption and key.

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}

Answer

"Condition": {"StringEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}

Answer

"Condition": {"Null": {"s3:x-amz-server-side-encryption": "false"}}

Question 13

A SysOps administrator needs to ensure that an Amazon RDS instance is encrypted at rest. The instance is already provisioned unencrypted. What is the correct approach to enable encryption?

Accepted Answer

Create a snapshot of the instance and restore it with encryption enabled. RDS encryption can only be enabled at creation time. For an existing unencrypted instance, you must create a snapshot, copy it with encryption, and restore from that encrypted snapshot. Modifying the instance or enabling encryption on the fly is not supported.

Answer

Use AWS KMS to encrypt the underlying EBS volumes of the RDS instance

Answer

Enable encryption using the AWS CLI command modify-db-instance

Answer

Modify the RDS instance and enable encryption in the configuration

Question 14

A company uses AWS Organizations to manage multiple accounts. The security team wants to restrict all accounts from using specific AWS services unless explicitly allowed. Which feature should be used?

Accepted Answer

Service control policies (SCPs). Service control policies (SCPs) are used in AWS Organizations to define the maximum permissions for accounts in the organization. SCPs can deny or allow services at the organization, OU, or account level. IAM policies are for individual users/roles, not for account-wide restrictions. Resource-based policies are for specific resources. AWS Config rules evaluate compliance but do not restrict usage.

Answer

Resource-based policies

Answer

IAM permissions boundaries

Answer

AWS Config rules

Question 15

An application running on Amazon EC2 needs to access an S3 bucket. The SysOps administrator wants to ensure that only that specific EC2 instance can access the bucket, without storing any long-term credentials on the instance. What is the most secure way to achieve this?

Accepted Answer

Attach an IAM role to the EC2 instance using an instance profile and grant the role S3 access. Using an instance profile with an IAM role is the most secure method. The instance profile is attached to the EC2 instance, and the role provides temporary credentials via the metadata service. The S3 bucket policy can then restrict access to that specific IAM role. Storing access keys on the instance is insecure. Using pre-signed URLs is for individual objects, not ongoing access. A resource-based policy on the EC2 instance is not applicable.

Answer

Configure a resource-based policy on the EC2 instance to allow S3 access

Answer

Create an IAM user with S3 access and store the access keys in the instance's user data

Answer

Generate pre-signed URLs for each S3 object the application needs to access