SOA-C02 Security and Compliance Practice Question
A company's security policy requires that all IAM user passwords must be at least 12 characters long. The SysOps administrator needs to enforce this requirement across the AWS account. Which action should the administrator take?
⚠ Common exam trap
Test-takers frequently confuse AWS Config (which can detect but not enforce password length at creation time) with the IAM password policy (which is the correct, built-in enforcement mechanism), or they mistakenly think SCPs can inspect password content when they only control API actions at a high level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the IAM account password policy to require a minimum length of 12 characters.
The IAM account password policy is the native AWS mechanism for enforcing password requirements across all IAM users in an account. By updating this policy to require a minimum length of 12 characters, the administrator ensures that any new or changed password must comply, and existing passwords are not affected until the next change. This is a direct, account-wide setting that requires no additional services or custom logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an AWS Config rule to check password length and auto-remediate.
Why it's wrong here
An AWS Config rule can detect passwords that do not meet the length requirement after they are set, but it cannot prevent users from setting short passwords in the first place. It is not a preventative control.
- ✓
Update the IAM account password policy to require a minimum length of 12 characters.
Why this is correct
The IAM account password policy is the native, preventative control that enforces password requirements at the account level for all IAM users. When you set a minimum length of 12 characters, IAM rejects any password creation or change that does not meet this threshold, ensuring compliance before the password is ever stored. This is the intended mechanism that directly satisfies the security policy requirement.
- ✗
Enable AWS CloudTrail to monitor for password changes and alert the administrator.
Why it's wrong here
CloudTrail is a detective audit service that records API activity such as ChangePassword, CreateUser, and GetAccountPasswordPolicy, but it does not inspect the actual password content or enforce a minimum length. Enabling CloudTrail and alerting would only provide after-the-fact visibility into password changes, allowing non-compliant passwords to be set and used in the interim. Alert-based monitoring cannot prevent the violation, so it fails as a preventative security control.
- ✗
Attach a service control policy (SCP) that denies IAM user creation if the password is less than 12 characters.
Why it's wrong here
Service control policies (SCPs) are AWS Organizations permissions guards that can deny IAM actions like CreateUser or CreateLoginProfile, but they cannot evaluate the value of the password parameter in the request. IAM password length validation occurs internally during the CreateLoginProfile call, and no SCP condition key exposes the password content to an SCP. Additionally, if the account is not in an Organization, SCPs do not apply at all, making this option both technically and operationally ineffective.
Go deeper
Related to this question
About these practice questions
One of 247 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.