Security and Compliance — SOA-C03 Practice Quiz

Question 1

A CloudOps engineer manages several Application Load Balancers that use TLS certificates issued by AWS Certificate Manager (ACM). Some certificates were imported into ACM from a third-party certificate authority, while others were requested directly from ACM. The security team wants proactive alerts at least 30 days before any certificate expires so they can renew in time. Which approach requires the LEAST ongoing operational effort to ensure the team is notified before expiration?

Accepted Answer

Create an EventBridge rule that matches the ACM 'ACM Certificate Approaching Expiration' event and routes it to an SNS topic to notify the security team.

Answer

Rely on ACM automatic renewal for all certificates, since ACM renews certificates before they expire without any manual intervention.

Answer

Enable the ACM-managed AWS Config rule and use a Lambda function that runs daily to describe each certificate and calculate days to expiry, then publish to SNS.

Answer

Create a CloudWatch alarm on the ACM DaysToExpiry metric for each certificate ARN and set the threshold to 30 days, sending notifications to SNS.

Question 2

A CloudOps engineer is deploying a global web application that uses Amazon CloudFront as the CDN with a custom domain name. The engineer requests an ACM certificate in the eu-west-1 Region (where the origin ALB resides) and attempts to associate it with the CloudFront distribution, but the certificate does not appear as a selectable option in the CloudFront console. What is the correct action to resolve this?

Accepted Answer

Request or import the ACM certificate in the us-east-1 Region, because CloudFront only accepts certificates from us-east-1.

Answer

Enable cross-region certificate replication on the eu-west-1 certificate so CloudFront can reference it.

Answer

Attach the ACM certificate to the origin ALB first, then CloudFront will automatically inherit it.

Answer

Convert the ACM certificate to an IAM server certificate and upload it to the us-east-1 Region.

Question 3

A company runs internal microservices on EC2 instances within a private VPC. Security policy requires all service-to-service communication to use TLS with certificates issued from a trusted internal certificate authority. The certificates must not be publicly trusted, and the company wants to automate issuance and renewal without managing its own CA infrastructure on servers. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Private CA (AWS Certificate Manager Private Certificate Authority) to issue certificates for internal services, integrating with ACM for automated renewal.

Answer

Request public certificates from AWS Certificate Manager (ACM) and distribute them to each internal service.

Answer

Deploy an OpenSSL-based CA on an EC2 instance and write cron jobs to issue and rotate certificates for each microservice.

Answer

Import self-signed certificates into ACM and reference them from each EC2 instance.

Question 4

A financial services company must be able to prove during audits that its AWS API activity logs have not been altered or deleted after being written. The security team already has a CloudTrail trail delivering logs to an S3 bucket, but auditors require cryptographic proof that no log files were tampered with between delivery and review. Which action provides this assurance with the least operational overhead?

Accepted Answer

Enable CloudTrail log file integrity validation, which generates digest files that let you verify whether log files were modified or deleted.

Answer

Enable S3 default encryption with SSE-KMS on the log bucket so that any unauthorized modification of log files is automatically blocked.

Answer

Turn on S3 Versioning on the log bucket and periodically compare object versions to detect changes.

Answer

Configure an AWS Config rule that checks whether CloudTrail is enabled and alerts when the trail is disabled.

Question 5

A company uses AWS Organizations with 40 member accounts. The security team needs to capture all management event API activity across every existing and future account, delivering logs to a single S3 bucket in a dedicated logging account. Member account administrators must not be able to modify or delete the trail configuration in their own accounts. Which approach meets these requirements with the least ongoing administrative effort?

Accepted Answer

Create an organization trail from the Organizations management account that logs to the centralized S3 bucket in the logging account.

Answer

Instruct each member account administrator to create a trail that delivers logs to the centralized S3 bucket, and audit compliance monthly.

Answer

Create a CloudFormation StackSet that deploys an individual per-account trail to all member accounts and reruns weekly to catch new accounts.

Answer

Enable AWS Config in all accounts and use a conformance pack to forward configuration snapshots to the logging account bucket.

Question 6

A CloudOps engineer manages compliance for an organization with 40 AWS accounts across 3 regions using AWS Organizations. The security team wants a single, centralized dashboard showing the compliance status of AWS Config rules across all member accounts and regions without logging into each account individually. AWS Config is already enabled in every account and region. What is the MOST operationally efficient way to provide this centralized view?

Accepted Answer

Create an AWS Config aggregator in a designated account that is authorized to aggregate data from the entire organization, then view aggregated compliance in that account's Config console.

Answer

Configure each member account to publish Config snapshots to a central S3 bucket and build an Amazon QuickSight dashboard that queries the aggregated data with Athena.

Answer

Use AWS Config conformance packs deployed individually in each account and manually compile the compliance reports into a shared spreadsheet weekly.

Answer

Enable CloudTrail organization trails and create CloudWatch dashboards that count Config rule evaluation API calls across accounts.

Question 7

A CloudOps engineer must ensure that all RDS database instances across a single account have deletion protection enabled. The security team wants a fully managed, low-maintenance solution that continuously evaluates existing and newly created RDS instances and records compliance status, without the engineer writing or maintaining any evaluation logic. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable the AWS Config managed rule rds-instance-deletion-protection-enabled and view compliance results in the AWS Config dashboard.

Answer

Create an AWS Config custom rule backed by a Lambda function that describes each RDS instance and evaluates the DeletionProtection attribute.

Answer

Create an EventBridge rule that triggers a Lambda function on RDS API calls to check deletion protection and publish findings to Security Hub.

Answer

Use AWS CloudTrail with Athena queries scheduled daily to identify RDS instances that were created without deletion protection.

Question 8

A CloudOps engineer must provide auditors with evidence that all API activity in an AWS account is being recorded, that resource configurations are continuously evaluated against a security baseline, and that a prioritized, aggregated view of findings across multiple compliance standards (such as CIS and PCI DSS) is available. Which combination of services, used for its intended purpose, satisfies these requirements?

Accepted Answer

Use CloudTrail for API activity logging, AWS Config for continuous configuration evaluation, and Security Hub to aggregate and prioritize findings against multiple standards.

Answer

Use Amazon CloudWatch Logs for API activity logging, AWS Config for configuration snapshots, and GuardDuty to prioritize compliance standard findings.

Answer

Use CloudTrail for both API activity logging and continuous configuration evaluation, and IAM Access Analyzer to aggregate findings against compliance standards.

Answer

Use AWS Config for API activity logging, CloudTrail for configuration evaluation, and Amazon Inspector to aggregate findings against multiple standards.

Question 9

A CloudOps engineer must continuously evaluate whether all EBS volumes, RDS instances, and S3 buckets across every account in an AWS Organization are encrypted at rest. Leadership wants a single, standardized set of encryption compliance rules deployed centrally and applied to all member accounts, with results aggregated for auditors. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Deploy an AWS Config conformance pack containing the encryption managed rules from the organization management (or delegated administrator) account across the organization, and use a Config aggregator to consolidate compliance results.

Answer

Enable AWS CloudTrail organization trails and write a Lambda function that parses log events to detect resources created without encryption.

Answer

Manually create individual AWS Config rules for encryption in each member account and review each account's Config dashboard separately.

Answer

Attach a Service Control Policy that denies creation of any unencrypted resource, and rely on the SCP denials to report ongoing compliance status.

Question 10

A CloudOps engineer manages a fleet of EC2 instances that must always have IMDSv2 enforced. Occasionally, developers launch instances with IMDSv1 enabled through the console. The team wants AWS Config to not only detect noncompliant instances but also automatically remediate them by requiring the token-based metadata endpoint, without manual intervention. Which approach satisfies this requirement?

Accepted Answer

Create an AWS Config managed rule (ec2-imdsv2-check) and attach an automatic remediation action that invokes an SSM Automation document to set the instance metadata options to require tokens.

Answer

Enable the AWS Foundational Security Best Practices standard in Security Hub, which will automatically reconfigure noncompliant instances to enforce IMDSv2.

Answer

Create a CloudTrail metric filter on RunInstances events and trigger an SNS notification so an administrator can manually fix the instance.

Answer

Use an IAM permission boundary that prevents developers from launching instances unless IMDSv2 is enabled, blocking the noncompliant configuration entirely.

Question 11

A CloudOps engineer must continuously detect any EBS volumes in a production account that are created without encryption, so the compliance team receives an alert and a historical record of when each violation occurred. The solution must require minimal custom code and provide a queryable timeline of resource compliance state changes. Which approach best meets these requirements?

Accepted Answer

Enable AWS Config with the managed rule 'encrypted-volumes' and configure an EventBridge rule on Config compliance-change events to notify the compliance team via SNS.

Answer

Create a CloudTrail trail and write a Lambda function triggered on each CreateVolume API call to check the encryption parameter and publish to SNS.

Answer

Enable Amazon Inspector on all EC2 instances to scan attached volumes for encryption weaknesses and route findings to Security Hub.

Answer

Schedule an SSM Automation runbook to run a daily describe-volumes command and email a report of any unencrypted volumes found.

Question 12

A CloudOps engineer manages AWS Config across an organization. A security requirement mandates that data at rest in Amazon RDS must be encrypted using a customer managed KMS key rather than the default AWS managed key. The team already has an AWS Config rule detecting unencrypted RDS instances, but they now need automatic email alerts to the security team whenever any resource is evaluated as NON_COMPLIANT, without writing custom evaluation logic. Which approach meets this requirement with the least operational effort?

Accepted Answer

Create an Amazon EventBridge rule that matches AWS Config compliance change events with a NON_COMPLIANT state and targets an Amazon SNS topic subscribed by the security team.

Answer

Enable an AWS Config conformance pack and configure it to send SMTP email directly to the security team's distribution list on each failed evaluation.

Answer

Write a Lambda function invoked on a schedule that calls the AWS Config API, filters NON_COMPLIANT resources, and sends email through Amazon SES.

Answer

Configure an Amazon CloudWatch alarm on the AWS Config compliance metric and set the alarm action to notify the security team via SNS.

Question 13

A CloudOps engineer must prove to auditors that all RDS DB instances across the company's production account have encryption at rest enabled, and must be alerted whenever a non-compliant instance is created. The solution should require minimal ongoing operational effort and provide a historical record of compliance status over time. Which approach best meets these requirements?

Accepted Answer

Enable the AWS Config managed rule 'rds-storage-encrypted' and configure an Amazon SNS notification on the rule's compliance change events.

Answer

Create a CloudTrail trail and write a CloudWatch Logs metric filter that matches CreateDBInstance events with StorageEncrypted set to false, then trigger an alarm.

Answer

Schedule an AWS Lambda function to run daily that calls DescribeDBInstances, checks the StorageEncrypted attribute, and emails a report to the audit team.

Answer

Enable Amazon GuardDuty and subscribe to findings that indicate unencrypted RDS storage, forwarding them to the security team via EventBridge.

Question 14

A CloudOps engineer must ensure that all newly created RDS instances in a production account automatically have their public accessibility setting disabled if a developer accidentally enables it. The remediation must run without human intervention and must be triggered by the configuration change. Which approach best meets this requirement?

Accepted Answer

Create an AWS Config managed rule to detect publicly accessible RDS instances and attach an automatic remediation action that invokes an SSM Automation document to disable public access.

Answer

Enable the AWS Foundational Security Best Practices standard in Security Hub and rely on its findings to disable public access on the RDS instances.

Answer

Create a CloudWatch alarm on the RDS PubliclyAccessible metric and send an SNS notification to the operations team to manually disable access.

Answer

Enable Amazon GuardDuty and create a filter for RDS public access findings that triggers an EventBridge rule to notify administrators.

Question 15

A CloudOps engineer at a financial services company must continuously identify any S3 buckets, IAM roles, KMS keys, and SQS queues in a production account whose resource-based policies grant access to external principals outside the organization. The security team wants findings generated automatically whenever a policy is created or modified, with the ability to confirm known cross-account sharing as intended. Which solution meets these requirements with the least operational effort?

Accepted Answer

Enable IAM Access Analyzer with an analyzer scoped to the AWS Organization as the zone of trust, and review and archive findings for known intended external access.

Answer

Create an AWS Config custom rule that parses each resource's policy document with a Lambda function and flags any statement containing a principal from another account.

Answer

Enable Amazon GuardDuty in the production account and create EventBridge rules to alert on cross-account access findings.

Answer

Use IAM Access Advisor to review last-accessed data for each role and manually inspect bucket policies for external principals.

Question 16

A CloudOps engineer is tasked with tightening IAM permissions across a single AWS account. The security team wants to identify IAM roles and users that have permissions they have not used in the last 90 days, so those excess permissions can be removed to enforce least privilege. The engineer wants a native, low-maintenance AWS solution that automatically surfaces these findings without writing custom scripts to parse logs. Which approach should the engineer implement?

Accepted Answer

Enable IAM Access Analyzer with an unused access analyzer, then review the generated findings for unused roles, permissions, and access keys.

Answer

Enable an IAM Access Analyzer external access analyzer to detect resources shared outside the account and remove any unused permissions it reports.

Answer

Create an AWS Config rule that evaluates IAM policy documents and flags any policy granting more than read-only access.

Answer

Write a Lambda function that parses CloudTrail management events daily to build a report of each principal's last-used actions.

Question 17

A CloudOps engineer works for a SaaS monitoring vendor that must access its customers' AWS accounts to read CloudWatch metrics. Each customer creates an IAM role that trusts the vendor's AWS account and grants read-only CloudWatch access. During a security review, the engineer is warned that a malicious third party who learns a customer's role ARN could potentially trick the vendor's service into assuming that role on the attacker's behalf. Which approach should the vendor require its customers to implement to prevent this cross-account access risk?

Accepted Answer

Require each customer to include a unique external ID in the role's trust policy condition that the vendor supplies and passes on every AssumeRole call.

Answer

Require each customer to attach a permissions boundary to the IAM role limiting it to CloudWatch read-only actions.

Answer

Require each customer to add an IP-address condition to the role trust policy restricting AssumeRole to the vendor's NAT gateway addresses.

Answer

Require each customer to enable MFA on the IAM role and provide the vendor with a hardware token for each account.

Question 18

A CloudOps engineer manages an AWS account where 40 developers each have IAM users. Currently, permissions are assigned by attaching inline policies directly to each user, and updating a single permission requires editing every user individually. The team wants a scalable approach that reduces administrative overhead and ensures consistent permissions across all developers, while still allowing a subset of developers to receive additional temporary permissions when working on a special project. Which approach best meets these requirements?

Accepted Answer

Create an IAM group with a managed policy for the common developer permissions and add all developers to it; create a second group for the special-project permissions and add only the relevant developers to that group.

Answer

Consolidate all permissions into a single AWS managed policy and attach it as an inline policy to each of the 40 IAM users.

Answer

Create a permission boundary that grants the common developer permissions and attach it to each IAM user, updating the boundary when the special project starts.

Answer

Create one IAM role with all common and special-project permissions and share its access keys with all 40 developers.

Question 19

A company allows developers in each project team to create IAM roles for their own applications so they can move quickly. Security is concerned that a developer could create a role with full administrative access and attach it to an application. The security team wants developers to retain the ability to create roles and attach policies, but wants to guarantee that any role they create can never obtain permissions beyond a defined set (such as S3, DynamoDB, and CloudWatch access). What is the MOST appropriate way to enforce this constraint?

Accepted Answer

Attach a permission boundary to the developer IAM users and use a condition that requires them to attach the same permission boundary to any role they create.

Answer

Create a Service Control Policy in AWS Organizations that denies the iam:CreateRole action for all developers.

Answer

Grant developers full IAM access and rely on AWS Config rules to detect and delete any overly permissive roles after creation.

Answer

Use IAM Access Analyzer to continuously scan created roles and automatically revoke administrative permissions.

Question 20

A CloudOps engineer is troubleshooting access for a developer who cannot upload objects to an S3 bucket. The developer is a member of an IAM group that has an attached policy allowing s3:PutObject on the bucket. The bucket policy also allows the developer's IAM user to perform s3:PutObject. However, a permissions boundary attached to the IAM user allows only s3:GetObject and s3:ListBucket. What is the reason the upload is failing?

Accepted Answer

The permissions boundary limits the user's maximum permissions to only the actions it allows, so s3:PutObject is not effectively granted.

Answer

Bucket policies always override IAM identity-based policies, and the bucket policy is missing an explicit s3:PutObject grant.

Answer

IAM group policies do not apply to individual users unless the user is also granted the same policy directly.

Answer

The permissions boundary grants additional permissions, so PutObject should work; the failure must be caused by a bucket ACL.

More SOA-C03 practice