SOA-C02 Security and Compliance — Timed 10 Questions

Question 1

An organization requires that all Amazon S3 buckets be encrypted at rest by default. A SysOps administrator needs to enforce this using AWS Config. Which AWS Config managed rule should be used?

Accepted Answer

s3-bucket-encryption-enabled. The AWS Config managed rule `s3-bucket-encryption-enabled` checks whether S3 buckets have default encryption enabled (SSE-S3, SSE-KMS, or SSE-C). This directly enforces the requirement that all buckets are encrypted at rest by default, as it evaluates each bucket's encryption configuration and flags non-compliant resources.

Answer

s3-bucket-ssl-requests-only

Answer

s3-bucket-public-read-prohibited

Answer

s3-bucket-logging-enabled

Question 2

A SysOps administrator needs to ensure that all traffic to an Application Load Balancer (ALB) uses encryption. How can this be enforced?

Accepted Answer

Create a listener that redirects HTTP requests (port 80) to HTTPS (port 443).. Option B is correct because an Application Load Balancer can be configured with a listener rule that redirects incoming HTTP (port 80) requests to HTTPS (port 443). This ensures that all traffic to the ALB is encrypted in transit, as any unencrypted HTTP request is automatically redirected to the secure HTTPS protocol. The redirect action is a native ALB feature and does not require additional services or complex configurations.

Answer

Configure the security group to allow only HTTPS traffic (port 443).

Answer

Use AWS WAF to block HTTP requests.

Answer

Configure the ALB to use a custom SSL certificate.

Question 3

An organization requires that all Amazon S3 buckets block public access entirely. A SysOps administrator needs to ensure that no bucket can be made public, even accidentally. Which approach enforces this control at the organizational level?

Accepted Answer

Enable S3 Block Public Access at the account level and attach an SCP to deny changes to it.. Option C is correct because S3 Block Public Access at the account level provides a centralized, immutable control that prevents any bucket in the account from being made public, regardless of bucket policies or ACLs. Attaching an SCP (Service Control Policy) to deny changes to these settings ensures that even administrators with full IAM permissions cannot disable the block, enforcing the control at the organizational level across all accounts in the organization.

Answer

Apply an S3 Bucket Policy on each bucket that denies public access.

Answer

Use an AWS Config managed rule 's3-bucket-public-read-prohibited' to detect and remediate public buckets.

Answer

Create an IAM policy that denies s3:PutBucketPolicy for all users.

Question 4

A company's security team requires that all Amazon EC2 instances in a specific AWS account must have the tag 'Environment' set to either 'Production' or 'Test'. Any instance that is launched without this tag or with an invalid value must be automatically terminated within five minutes. Which combination of AWS services can enforce this requirement with minimal manual intervention?

Accepted Answer

AWS Config with a custom rule and AWS Lambda. AWS Config with a custom rule can evaluate EC2 instances for the required 'Environment' tag with valid values. When a non-compliant instance is detected, AWS Config triggers an AWS Lambda function that terminates the instance within the required five-minute window. This combination provides automated, event-driven enforcement with minimal manual intervention.

Answer

AWS CloudTrail and Amazon CloudWatch Events

Answer

AWS Service Catalog and AWS Organizations

Answer

Amazon Inspector and AWS Systems Manager

Question 5

A company has an AWS account that contains multiple Amazon S3 buckets with sensitive data. A SysOps administrator needs to ensure that all S3 buckets in the account have versioning enabled to protect against accidental deletions. The administrator wants to automatically remediate any bucket that is created without versioning enabled. Which solution should be used?

Accepted Answer

Use AWS Config with a managed rule (s3-bucket-versioning-enabled) and an automatic remediation action that uses an AWS Systems Manager Automation document to enable versioning. AWS Config with the managed rule `s3-bucket-versioning-enabled` continuously evaluates S3 buckets against the desired configuration. When a noncompliant bucket is detected, an automatic remediation action can be configured to invoke an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven remediation without manual intervention, ensuring all buckets—including those created outside of AWS Config's initial evaluation—are brought into compliance.

Answer

Use Amazon CloudWatch Events to detect CreateBucket API calls and trigger an AWS Lambda function to enable versioning

Answer

Use AWS CloudTrail to monitor CreateBucket events and send an alert to the SysOps administrator for manual action

Answer

Use AWS Service Catalog to enforce versioning on all buckets provisioned through it

Question 6

An organization requires that all Amazon EC2 instances must be launched only with approved Amazon Machine Images (AMIs) that have been pre-approved by the security team. The SysOps administrator needs to enforce this policy for all current and future instances in the AWS account. Unapproved AMIs should be prevented from launching. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Config with the 'approved-amis-by-id' managed rule to evaluate and automatically remediate noncompliant instances.. AWS Config with the 'approved-amis-by-id' managed rule continuously evaluates EC2 instances against a list of approved AMI IDs. When a noncompliant instance is detected, you can configure automatic remediation (e.g., using AWS Systems Manager Automation to stop or terminate the instance). This approach enforces the policy for both existing and future instances with minimal operational overhead, as it requires no custom code or manual policy updates.

Answer

Use an AWS Service Control Policy (SCP) to deny ec2:RunInstances if the AMI ID is not in an approved list.

Answer

Create an IAM policy that denies ec2:RunInstances for any AMI not on an approved list and attach it to all IAM users and roles.

Answer

Use AWS Systems Manager Patch Manager to approve AMIs and configure the fleet to use only approved images.

Question 7

A company uses Amazon S3 to store sensitive customer data. A SysOps administrator needs to ensure that any S3 bucket that is incorrectly configured to allow public read access is automatically remediated within five minutes. The administrator wants to use native AWS services with minimal custom code. Which solution should be used?

Accepted Answer

Use AWS Config with the 's3-bucket-public-read-prohibited' managed rule and configure automatic remediation to block public access.. AWS Config with the 's3-bucket-public-read-prohibited' managed rule can automatically evaluate S3 bucket configurations against the desired state. When a non-compliant bucket is detected, AWS Config can trigger an automatic remediation action (e.g., applying an S3 bucket policy or blocking public access) using AWS Systems Manager Automation documents, all within the required five-minute window and with minimal custom code.

Answer

Create an Amazon EventBridge (CloudWatch Events) rule that triggers an AWS Lambda function to check and fix public read access.

Answer

Apply an S3 bucket policy to each bucket that denies public read access.

Answer

Use AWS Trusted Advisor to check for public read access and manually remediate when notified.

Question 8

A company's security policy requires that all Amazon RDS for PostgreSQL instances be encrypted at rest using AWS Key Management Service (KMS) customer managed keys and have automated backups enabled with a retention period of at least 30 days. A SysOps administrator needs to use AWS Config to automatically detect any RDS instance that is non-compliant with either requirement and automatically remediate it. Which combination of AWS Config managed rules and remediation actions should be used?

Accepted Answer

Use the AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure automatic remediation for each rule using the corresponding AWS Systems Manager Automation runbook: 'AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup'.. Option C is correct because AWS Config managed rules 'rds-instance-encrypted' and 'rds-backup-enabled' natively evaluate encryption and backup compliance. The corresponding AWS Systems Manager Automation runbooks ('AWSConfigRemediation-EnableRDSInstanceEncryption' and 'AWSConfigRemediation-EnableRDSInstanceBackup') provide built-in, automatic remediation without custom code, aligning with the requirement to use managed rules and automatic remediation.

Answer

Use two AWS Config managed rules: 'rds-instance-encrypted' and 'rds-backup-enabled'. Configure each rule with an automatic remediation action that triggers an Amazon CloudWatch alarm, which then invokes an AWS Lambda function to enable encryption and backups.

Answer

Create custom AWS Config rules as AWS Lambda functions that evaluate the RDS instance configuration. In the Lambda function, if a resource is non-compliant, call the RDS API to enable encryption and modify backup settings.

Answer

Use a single custom AWS Config rule that checks both encryption and backup settings. If non-compliant, trigger an AWS Lambda function that uses the RDS API to configure both settings.

Question 9

A company's security policy requires that all Amazon S3 buckets must have server-side encryption with AWS Key Management Service (SSE-KMS) enabled. The SysOps administrator needs to automatically detect any existing or new S3 bucket that does not have SSE-KMS enabled and automatically apply the encryption configuration. The solution must use managed AWS services with minimal custom code. Which combination of AWS services should be used?

Accepted Answer

Use AWS Config with a custom rule backed by an AWS Lambda function that checks if 'x-amz-server-side-encryption' is 'aws:kms' and auto-remediates by attaching a bucket policy that denies PUTs without SSE-KMS.. Option A is correct because it uses AWS Config with a custom Lambda-backed rule to detect non-compliant S3 buckets (those missing SSE-KMS) and auto-remediate by attaching a bucket policy that denies PUT requests without the 'x-amz-server-side-encryption: aws:kms' header. This satisfies the requirement for minimal custom code (only the Lambda function) and uses managed AWS services (AWS Config, Lambda, S3) to automatically detect and fix both existing and new buckets.

Answer

Enable default encryption on the AWS account's S3 buckets using an S3 account-level setting in the S3 console, which automatically applies SSE-KMS to all new buckets.

Answer

Create an AWS CloudTrail event that triggers an AWS Lambda function when a bucket is created, and the Lambda applies SSE-KMS encryption. Use AWS Config to periodically scan existing buckets and apply encryption.

Answer

Use AWS Identity and Access Management (IAM) with a Service Control Policy (SCP) that denies any S3 bucket creation without SSE-KMS enabled, and use AWS Config to detect and notify on non-compliance.

Question 10

An organization wants to ensure that no Amazon S3 bucket in the entire AWS Organization can be made public. The security team requires a preventive control that cannot be overridden by individual account administrators. Which AWS service or feature should be used?

Accepted Answer

Create a Service Control Policy (SCP) in AWS Organizations that denies permissions to modify S3 bucket public access settings.. A Service Control Policy (SCP) in AWS Organizations is a preventive guard that applies to all accounts within the organization. It can explicitly deny actions like s3:PutBucketPublicAccessBlock, s3:PutBucketPolicy, and s3:PutObjectAcl, preventing any principal (including root users) from making S3 buckets public. Unlike detective or account-level controls, SCPs cannot be overridden by individual account administrators, meeting the requirement for a non-overridable preventive control.

Answer

Enable AWS Config rules in each account to detect public S3 buckets and automatically remediate them using AWS Lambda.

Answer

Use an IAM policy attached to all IAM users in each account that denies s3:PutBucketPolicy.

Answer

Apply Amazon S3 Block Public Access at the account level in each individual AWS account.