SOA-C02 Security and Compliance Practice Question

Exhibit

Refer to the exhibit.

```
$ aws iam get-account-password-policy
{
    "PasswordPolicy": {
        "MinimumPasswordLength": 12,
        "RequireSymbols": true,
        "RequireNumbers": true,
        "RequireUppercaseCharacters": true,
        "RequireLowercaseCharacters": true,
        "AllowUsersToChangePassword": true,
        "ExpirePasswords": true,
        "MaxPasswordAge": 90,
        "PasswordReusePrevention": 5,
        "HardExpiry": false
    }
}
```

Refer to the exhibit. A SysOps administrator reviews the account password policy. Which of the following is true based on this output?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Users cannot reuse their last 5 passwords

The output shows MaxPasswordAge: 90 and ExpirePasswords: true, meaning passwords expire after 90 days. PasswordReusePrevention: 5 means users cannot reuse the last 5 passwords. Option B is correct. Option A is wrong because password expiration is enabled (ExpirePasswords: true). Option C is wrong because MaximumPasswordAge is 90 days. Option D is wrong because HardExpiry is false, meaning users can change expired passwords.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Passwords do not expire
Why it's wrong here
The statement that passwords do not expire is false because the IAM password policy for this account has ExpirePasswords set to true. With ExpirePasswords enabled, IAM enforces password expiration based on the MaxPasswordAge value, which is 90 days in this policy. Therefore, passwords do expire after the configured lifetime, and users will be required to set a new password at that interval.
✓
Users cannot reuse their last 5 passwords
Why this is correct
This statement is correct. The IAM password policy includes PasswordReusePrevention configured to 5, which prevents a user from reusing any of their previous 5 passwords when changing or resetting a password. This means the specified number of previous passwords is stored and cannot be reused, directly matching the statement.
✗
The maximum password age is 120 days
Why it's wrong here
The claim that the maximum password age is 120 days is incorrect. The actual MaxPasswordAge setting in the displayed IAM password policy is 90 days, which determines the maximum number of days a password can remain valid before expiration. Since it is 90 and not 120, the statement does not reflect the policy.
✗
Users cannot change expired passwords
Why it's wrong here
The statement that users cannot change expired passwords is false because HardExpiry is set to false in the policy. When HardExpiry is false, an expired password can still be changed by the user during their next sign-in; they are prompted to set a new password and can proceed without administrator intervention. If HardExpiry were true, an admin would need to reset the password, but that is not the case here.

Go deeper

SOA-C02 Security and Compliance Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question