SOA-C02 Security and Compliance Practice Question
A company's security team notices that an IAM user has access keys that have not been rotated in over a year. Which action should the SysOps administrator take to enforce key rotation automatically?
⚠ Common exam trap
Many candidates confuse AWS Config's evaluation and remediation capabilities with IAM policies or Trusted Advisor, assuming those services can perform automated actions when they only provide static controls or recommendations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up an AWS Config rule to detect old keys and trigger an AWS Lambda function to rotate them.
AWS Config can evaluate IAM user access keys against a custom or managed rule (e.g., 'access-keys-rotated') to detect keys older than a specified threshold. When a non-compliant key is found, you can configure an AWS Config rule to invoke an AWS Lambda function that programmatically deactivates the old key and creates a new one, enforcing automatic rotation. This is the only native, automated approach that combines detection and remediation without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set up an AWS Config rule to detect old keys and trigger an AWS Lambda function to rotate them.
Why this is correct
This is the correct automated approach: AWS Config evaluates IAM access keys against a managed rule such as iam-user-access-key-age, and when a key exceeds the defined maximum age, Config triggers an AWS Lambda function as a remediation action. The Lambda function programmatically rotates the key—creating a new access key, updating or notifying the user, and retiring/deleting the old one—using IAM APIs without manual intervention.
- ✗
Apply a service control policy (SCP) that requires key rotation.
Why it's wrong here
SCPs are AWS Organizations policy types that define a guardrail for the maximum permissions available to member accounts, but they cannot initiate or schedule actions. An SCP could deny access to resources if a key is old, but it lacks the operational ability to rotate keys, and AWS does not provide a native SCP effect that enforces rotation timestamps. Thus, while an SCP could be part of an access-control strategy, it cannot automate rotation itself.
- ✗
Configure an IAM policy that automatically rotates keys every 90 days.
Why it's wrong here
IAM policies are static JSON documents that grant or deny permissions based on actions and resources; they have no temporal scheduling capability. IAM does not expose a feature or action to automatically rotate access keys on a schedule, and a policy cannot call the create-access-key, update-access-key, or delete-access-key APIs at a future time. Therefore, an IAM policy alone cannot implement rotation.
- ✗
Use AWS Trusted Advisor to automatically rotate the keys.
Why it's wrong here
AWS Trusted Advisor includes a check that flags IAM access keys older than 90 days, but it is a read-only recommendation service. It cannot perform mutation operations such as creating or deleting access keys, and it has no remediation or scheduling engine to rotate keys automatically. At best it provides a Security Hub or console notification that prompts a human to take manual action.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This SOA-C02 question is part of Courseiva's 1,169-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.