SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use a service control policy to deny kms:Decrypt for all users.

  Why it's wrong here

  A service control policy (SCP) is an account-level permission boundary that applies to every IAM principal in the account, including legitimate roles. Denying kms:Decrypt for all users would also block the EC2 service and any authorized administrator from decrypting EBS volumes, effectively breaking the entire encryption workflow. Moreover, SCPs cannot be targeted to specific roles, so they cannot enforce the required role-based restriction.

• ✗

  Apply a bucket policy on the EBS snapshot bucket.

  Why it's wrong here

  EBS snapshots are stored in an AWS-managed S3 bucket that you do not have access to, so you cannot attach a bucket policy to that underlying storage. Bucket policies only govern user-defined S3 buckets and do not control permissions for EBS volumes or their encrypted data. The encryption and decryption of snapshots is governed by the KMS key policy and IAM permissions, not by S3 bucket policies.

• ✓

  Modify the KMS key policy to allow only specific IAM roles to use kms:Decrypt.

  Why this is correct

  Modifying the KMS key policy is correct because KMS uses a key policy to specify which principals can use the key for cryptographic operations like kms:Decrypt. By allowing only specific IAM roles in the key policy, you ensure that only those roles (and any other explicitly authorized principals) can decrypt the EBS volumes and snapshots encrypted with that key. This works in conjunction with IAM policies; the key policy explicitly grants the roles decrypt access, while all other IAM principals are implicitly denied. You can further refine this with conditions such as kms:ViaService to limit decrypt calls to EC2.

• ✗

  Attach an instance profile with a policy that denies ec2:DetachVolume.

  Why it's wrong here

  An instance profile attached to an EC2 instance supplies temporary credentials for that instance to make API calls, but it cannot restrict IAM users or roles from performing kms:Decrypt. Denying ec2:DetachVolume only prevents the volume from being detached from the instance, not from reading data at rest; encrypted data remains protected by KMS and can still be decrypted by any principal with kms:Decrypt permission. This action does not address the core requirement of restricting decryption to specific IAM roles.

Go deeper

Related to this question