SOA-C02 Security and Compliance Practice Test 9 — 15 Questions

Question 1

A SysOps administrator deploys the CloudFormation template shown in the exhibit. The stack creation fails with a security group error. What is the most likely cause?

Accepted Answer

The template uses 'SecurityGroups' instead of 'SecurityGroupIds' for a VPC instance.. In a VPC, EC2 instances require security groups to be specified using the 'SecurityGroupIds' property (a list of security group IDs) instead of 'SecurityGroups', which is used only in EC2-Classic. The 'SecurityGroups' property expects security group names, but when referencing a security group created in the same template via the Ref intrinsic function, it returns the security group ID. Using 'SecurityGroups' with a Ref in a VPC causes a mismatch and results in a security group error. Options A, B, and D are incorrect: A is not related to security groups, B mentions an invalid CIDR but 10.0.0.0/8 is a valid private range, and D describes a security risk but not a stack creation failure.

Answer

The AMI ID is incorrect.

Answer

The security group ingress rule uses an invalid CIDR.

Answer

The security group ingress rule allows SSH from all IPs.

Question 2

A SysOps administrator is investigating an unauthorized stop of an EC2 instance. The CloudTrail log entry shows the event. What is the first step to determine if the action was authorized?

Accepted Answer

Check the IAM permissions of the user 'Admin' at the time of the event.. To determine if the EC2 instance stop was authorized, the first step is to check the IAM permissions of the user 'Admin' at the time of the event. CloudTrail logs include the identity of the IAM user who performed the action. By examining the permissions attached to that user (or the role assumed), you can verify whether they had the `ec2:StopInstances` permission. Option D is correct because it directly addresses the authorization check. Options A, B, and C are less direct or irrelevant: A (S3 bucket location) is not needed since the event is already visible; B (source IP) does not confirm authorization; C (instance state change history) duplicates CloudTrail data without addressing permissions.

Answer

Check the S3 bucket where CloudTrail logs are stored.

Answer

Verify the source IP address belongs to the company.

Answer

Check the EC2 instance's state change history.

Question 3

A company has a fleet of EC2 instances in an Auto Scaling group behind an Application Load Balancer. The security team requires that all traffic to the instances be encrypted in transit. Currently, the ALB terminates HTTPS and forwards HTTP to the instances. The security team wants to ensure that the traffic between the ALB and the instances is also encrypted. What should the SysOps administrator do to meet this requirement with minimal changes?

Accepted Answer

Change the ALB listener to use HTTPS and configure the target group to use HTTPS with a self-signed certificate on the instances.. It encrypts traffic between the ALB and EC2 instances with minimal changes: you change the ALB listener to HTTPS and configure the target group to use HTTPS, using a self-signed certificate on the instances for encryption. Option A is incorrect because replacing the ALB with a Network Load Balancer is not minimal and adds complexity. Option B is incorrect because adding a CloudFront distribution introduces additional cost and overhead, not minimal. Option C is incorrect because setting up a VPN connection is overly complex and not necessary for this requirement.

Answer

Replace the ALB with a Network Load Balancer and use TLS termination on the instances.

Answer

Place a CloudFront distribution in front of the ALB and use HTTPS for all origins.

Answer

Set up a VPN connection between the ALB and the instances.

Question 4

A company has an S3 bucket that stores sensitive customer data. The security team requires that all access to the bucket be logged for auditing. The SysOps administrator enabled S3 server access logging and configured the logs to be delivered to a different S3 bucket in the same account. However, after a week, the log bucket is empty. What is the most likely cause?

Accepted Answer

The log bucket has a bucket policy that denies access to the log delivery service.. The most likely cause is that the log delivery service is being denied by the destination bucket's bucket policy. S3 server access logs are delivered using a special log delivery service account (the S3 log delivery service). If the destination bucket has a bucket policy that explicitly denies PutObject actions for that service principal, logs will fail to be written. Option A is incorrect because lifecycle policies only affect object expiration/transition, not log delivery. Option B is incorrect because the ACL on the source bucket only controls access to the source bucket objects, not the ability of the log delivery service to write to the destination bucket. Option D is a possible cause because S3 server access logging requires the destination bucket to be in the same region as the source bucket; however, a region mismatch would prevent logs from being delivered at all, but the question states logs are empty after a week, and a bucket policy denial is a more common misconfiguration that can go unnoticed until logs are expected. Therefore, the most likely cause is a bucket policy on the destination bucket that denies the log delivery service.

Answer

The log bucket has no lifecycle policy.

Answer

The source bucket has an ACL that denies the log delivery service.

Answer

The log bucket is in a different region.

Question 5

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in member accounts must use MFA. They create an SCP that denies all actions if the IAM user does not have MFA. However, the SCP does not apply to the root user. The SysOps administrator finds that some IAM users in member accounts are still able to access the console without MFA. What is the most likely reason?

Accepted Answer

The SCP is applied to an OU that does not contain the affected accounts.. SCPs are applied at the OU level and affect all accounts within that OU and its descendant OUs. If the affected accounts are not in the OU where the SCP is applied, the SCP will not apply to them. Option B is incorrect because resource-based policies cannot override an SCP denial; SCPs act as a boundary policy that cannot be bypassed by resource-based policies. Option C is incorrect because SCPs apply to all IAM users and roles within the account, not just the root user. Option D is incorrect because SCPs are inherited by child OUs from their parent OUs.

Answer

The IAM user has a resource-based policy that allows access.

Answer

The SCP only applies to the root user, not IAM users.

Answer

The SCP is not inherited by child OUs.

Question 6

A company uses AWS KMS to encrypt data stored in S3. The security team wants to rotate the KMS key automatically every year. The SysOps administrator enabled automatic key rotation for the KMS key. However, after a year, the security team finds that the key has not been rotated. What is the most likely cause?

Accepted Answer

The KMS key was created by importing key material.. AWS KMS does not support automatic key rotation for customer-managed keys that were created by importing key material. This is a key limitation to remember. Options A and B are incorrect because automatic rotation is independent of the key's enabled state or the key policy; rotation occurs automatically for supported keys. Option C is incorrect because key usage is not a requirement for automatic rotation; the rotation schedule is based on time, not usage.

Answer

The KMS key is disabled.

Answer

The KMS key policy does not allow rotation.

Answer

The KMS key has not been used in the last year.

Question 7

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all new S3 buckets created in any account have encryption enabled. Which approach should be used to enforce this policy?

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes the x-amz-server-side-encryption header with a valid encryption algorithm.. Service Control Policies (SCPs) in AWS Organizations allow central governance to deny actions across all accounts. An SCP can deny the s3:CreateBucket action unless the request includes the server-side-encryption header, thus enforcing encryption on new buckets. Option B is incorrect because IAM roles per account lack centralized enforcement and cannot prevent users with their own permissions from creating buckets without encryption. Option C is incorrect because AWS Config rules are detective, not preventive; they can only detect and optionally remediate after the bucket is created, not block the creation. Option D is incorrect because using CloudTrail and CloudWatch Events with a Lambda function is a reactive approach—it can delete a non-compliant bucket after creation, but does not enforce encryption at the time of creation. The requirement is to enforce the policy, making a preventive SCP the correct solution.

Answer

Create an IAM role in each member account with a policy that denies s3:CreateBucket without encryption, and require all users to assume that role.

Answer

Use AWS Config managed rule 's3-bucket-server-side-encryption-enabled' to detect non-compliant buckets and automatically remediate.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule that triggers a Lambda function to delete any bucket created without encryption.

Question 8

A company wants to allow its DevOps team to launch EC2 instances using a specific AMI ID and only in a particular VPC. Which IAM policy should be used?

Accepted Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:Vpc":"vpc-12345678","ec2:ImageId":"ami-12345678"}}}. It uses an Allow effect with condition keys ec2:Vpc and ec2:ImageId to restrict the ec2:RunInstances action to only the specified VPC and AMI. Option A uses a Deny statement with StringNotEquals, which would block all instances not matching both conditions, but this approach can be overly restrictive and may interfere with other allowed actions. Option B only allows the action on the AMI resource ARN, but not on the instance resource (arn:aws:ec2:region::instance/*), so it would fail when launching instances. Option D only restricts the VPC, not the AMI, allowing instances from any AMI in that VPC.

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:Vpc":"vpc-12345678"},"StringNotEquals":{"ec2:ImageId":"ami-12345678"}}}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:region::image/ami-12345678"}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:Vpc":"vpc-12345678"}}}

Question 9

A company is using AWS CodePipeline to deploy a web application. The security team requires that all code changes be reviewed and approved before deployment to production. Which action should be taken to enforce this requirement?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline before the production deployment stage.. Adding a manual approval action in the CodePipeline pipeline before the production deployment stage enforces a required review and approval gate. This action pauses the pipeline at that point, waiting for an authorized user to manually approve the change before it proceeds to the production stage, directly meeting the security team's requirement.

Answer

Create an IAM policy that denies the codecommit:PutFile action unless the user is in a specific group.

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to notify the security team of any deployments.

Answer

Configure a CodeCommit repository to require pull requests for all changes.

Question 10

A company is using Amazon RDS for MySQL and needs to encrypt data at rest. Which action should be taken to enable encryption?

Accepted Answer

Create a new RDS DB instance with encryption enabled.. Amazon RDS for MySQL does not support enabling encryption on an existing DB instance. Encryption at rest must be enabled at the time of instance creation. Therefore, the correct action is to create a new RDS DB instance with encryption enabled, and then migrate the data from the unencrypted instance to the new encrypted one.

Answer

Use the RDS console to enable encryption on the existing DB instance.

Answer

Use AWS KMS to create a customer master key and assign it to the existing DB instance.

Answer

Modify the existing RDS DB instance and enable encryption.

Question 11

A company wants to provide temporary access to an S3 bucket for a third-party vendor. The vendor needs to upload files for one hour. Which approach should be used?

Accepted Answer

Generate a presigned URL for the S3 bucket that expires in one hour.. A presigned URL grants temporary access to upload files to a specific S3 bucket or object, with a configurable expiration time (e.g., one hour). This allows the vendor to upload without needing AWS credentials. Option A is wrong because cross-account IAM role assumption requires the vendor to have an AWS account and is more complex than needed for simple temporary uploads. Option B is wrong because sharing IAM user credentials violates security best practices and provides permanent access. Option C is wrong because an S3 bucket policy with IP address condition is not time-limited; it would grant permanent access from that IP unless manually revoked.

Answer

Create an IAM role and allow the vendor to assume it using their AWS account.

Answer

Create an IAM user with programmatic access and share the credentials with the vendor.

Answer

Create an S3 bucket policy that allows the vendor's IP address for one hour.

Question 12

A company has a VPC with public and private subnets. The private subnets contain RDS databases that should not be accessible from the internet. Which configuration ensures that the databases are only accessible from the application servers in the public subnets?

Accepted Answer

Create a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers.. Security groups act as a virtual firewall at the instance level, and you can reference another security group as a source. By creating a security group for the RDS instances that allows inbound traffic from the security group attached to the application servers, you ensure that only those application servers (regardless of their IP addresses) can reach the databases. This approach is more dynamic and secure than using CIDR-based rules, as it automatically accommodates changes in the application servers' IP addresses or scaling events.

Answer

Attach an internet gateway to the VPC and route the private subnet's traffic to it.

Answer

Attach a NAT gateway to the private subnet and route traffic through it.

Answer

Configure a network ACL on the private subnet to allow inbound traffic from the public subnet CIDR.

Question 13

A company wants to monitor for unauthorized API calls in their AWS account. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, and timestamp of each call. This enables monitoring for unauthorized API activity by analyzing the logs for suspicious patterns or unexpected actions. CloudTrail is specifically designed for auditing API usage, unlike other services that focus on resource configuration or threat detection.

Answer

Amazon CloudWatch

Answer

AWS Config

Answer

Amazon GuardDuty

Question 14

Which TWO actions can be used to protect data in transit between an EC2 instance and an S3 bucket? (Choose two.)

Accepted Answer

Use HTTPS instead of HTTP when accessing S3 from the EC2 instance.. HTTPS encrypts the data in transit between the EC2 instance and S3 using TLS, protecting it from eavesdropping or tampering. This ensures that the HTTP request and response payload, as well as headers, are encrypted over the network, which is a direct method to protect data in transit.

Answer

Configure security group rules on the EC2 instance to allow only S3 traffic.

Answer

Apply an S3 bucket policy that denies access unless the request includes the x-amz-server-side-encryption header.

Answer

Enable S3 default encryption (SSE-S3) on the bucket.

Question 15

Which THREE steps are required to enable AWS CloudTrail log file integrity validation? (Choose three.)

Accepted Answer

Enable CloudTrail to log management events and data events for all resources.. Enabling CloudTrail to log management events and data events for all resources is a prerequisite for log file integrity validation. The integrity validation process relies on digest files that contain hashes of the log files, and these digest files are only generated for trails that capture events. Without logging events, there are no log files to validate, making this step essential for the integrity validation feature to function.

Answer

Create a customer-managed KMS key to encrypt the digest files.

Answer

Configure CloudTrail to deliver logs to CloudWatch Logs for real-time analysis.