Security and Compliance (16%)

SOA-C03 · 48 questions

• A bank rotates its RDS master password by hand and has missed two rotations. The application reads the password from an environment variable set in the task definition. Operations wants automatic rotation and one place for the application to fetch the current value. What should they use?
• A city agency attaches an identity policy that allows s3:DeleteObject on a bucket, but deletes still fail with an explicit deny. An Organizations service control policy on the account denies s3:DeleteObject. Why do the deletes fail?
• A studio disabled a customer managed KMS key during cleanup. Applications can no longer read S3 objects that were encrypted with that key, and the objects are still in the bucket. What restores read access with the least data movement?
• A hospital wants a finding when an EC2 instance communicates with a known command-and-control address. Which service is built to raise that threat finding?
• A university must continuously detect security groups that allow 0.0.0.0/0 on port 22 and show each group as noncompliant until that rule is gone. A weekly look at the console is not enough. Which service should they use for the ongoing evaluation?
• A SaaS team wants to know whether an IAM user will be allowed to call ec2:RebootInstances after a policy edit, before anyone saves the policy or makes the call. Which tool gives that preview?
• Trusted Advisor reports that the root user of a bank account has no MFA. No person should use root for daily work. What should the account owner do about that finding?
• An identity policy on a retail role allows s3:PutObject on a bucket. Puts still fail. The role's permission boundary does not include s3:PutObject, and no service control policy mentions S3. Why is the call denied?
• An audit of a university account finds that IAM users can set short passwords that never expire. The auditor wants a minimum length and expiration for those IAM user passwords. What should be configured?
• A role in a logistics account can call S3, and its identity policy allows s3:GetObject on a bucket in a partner account. Gets still fail with Access Denied. The bucket is not public, and the partner's bucket policy has no statement for this role. What is missing?
• A company requires workforce access through federation, but one IAM user still has an active long-lived access key used by a script. What should operations do so that script follows the same rule?
• A records bucket should be readable only through one gateway VPC endpoint. The bucket policy allows the application role and has no condition on the endpoint. Calls from the public internet still succeed when the role's keys are used. What should the policy add?
• A role has two identity policies. One allows ec2:RebootInstances. The other explicitly denies ec2:RebootInstances. A reboot is denied. Why does the allow lose?
• IAM Access Analyzer reports that a log bucket policy allows a foreign account to call s3:GetObject. The security team thought the finding was about an expired password. What is the finding actually about?
• CloudTrail shows an s3:DeleteObject call made with an IAM user access key that the team thought was retired months ago. The user still owns other keys that a build uses. What should happen to the key in the event first?
• A role in account A can be assumed by principals in an account the company does not own. The trust policy's Principal lists that foreign account. Security thought a NACL was the cause. Where is the mistake?
• A production instance was rebooted last night. The team needs the IAM principal that called RebootInstances. Nobody is about to change a policy. Which record answers who did it?
• A role's identity policy allows s3:PutObject, and puts are denied. CloudTrail shows AccessDenied and does not name the statement. The role has a permission boundary that omits s3:PutObject. Which tool shows that the boundary is the cut, before the next live call?
• An engineer added an SCP that only contains Allow statements and expects those statements to grant S3 access in a member account. The account's identities have no identity policy allowing S3. Puts still fail. Why?
• A member account in a bank's organization enabled a Region the company forbids. New resources must not be created there. What should the organization attach so the account cannot use that Region?
• A new account was created and left in the organization root, outside the production OU. The production OU's SCP denies a Region, and the new account can still use that Region. Why was the guardrail missed?
• A city employee can open the development account through IAM Identity Center but is denied in the production account. The same permission set exists, and the production assignment was never created for this user. Why does production refuse the sign-in?
• A city's workforce signs in with individual passwords on a shared IAM user so they can all reach the same account. The company wants each person to receive their own access through a central directory. What should replace the shared user?
• A platform team tried to attach a service control policy inside a member account's IAM console, as if it were a user policy. The policy never took effect on the account. Where must that SCP be attached?
• A brokerage keeps AWS Config exceptions on a spreadsheet and wants the same rules evaluated in every account. What should they deploy?
• AWS Config reports that a bank data volume is unencrypted. Disabling the rule was proposed so the finding disappears. The data must stay in use, and the volume that stores it must actually be encrypted. How is that done?
• Trusted Advisor shows a university security group that allows a management port from the whole internet. An operator wants to exclude that check so the weekly report stays green. What should the operator do?
• A school district on Basic Support is treating a cost-optimization Trusted Advisor result that never updates as if it were live evidence. What should the team do?
• Trusted Advisor reports unrestricted access on a retailer's S3 bucket that should not be public. What should the team do?
• Trusted Advisor shows that an insurance company's root user still has an access key, and that key is not part of any approved workload. What should the team do?
• A city agency needs the ongoing timeline of how one security group's configuration changed. A single describe call was pasted into chat. Where does that continuous configuration timeline live?
• A payroll customer managed key is pending deletion, and objects are still encrypted with it. Someone wants to re-encrypt every object under a new key before the waiting period ends. The key cannot be used while deletion is pending. What should be done first?
• A university bucket stays public so students can download course files. Objects tagged Confidential must not be readable from that bucket. A wiki page tells staff not to upload those objects. What enforces the block?
• A research bucket mixes two data classes under one prefix. One class must expire sooner and stay private to one role, and the other must be retained and readable by a partner role. What lets lifecycle and access differ?
• A Macie sensitive-data finding says a permits bucket holds credentials inside object content. The on-call engineer wants to disable Macie so the finding disappears. What should the team do?
• A factory deployed the same AWS Config rule in every Region it uses. Only one Region produces no real compliance result, and the configuration recorder in that Region was never started. What should be started there?
• An application in account B cannot decrypt objects that account A encrypted with a customer managed key. The role in account B already allows kms:Decrypt. The key policy in account A has no statement for that role. What should change?
• A payments Lambda function stores an API token in an environment variable inside its CloudFormation template. The token must be removed from the template, and the function must still read it at runtime. What should change?
• A public Application Load Balancer for a patient portal listens only on HTTP. A certificate for the portal name is already issued in AWS Certificate Manager. How should inbound traffic be encrypted?
• A museum's public ACM certificate on an Application Load Balancer failed to renew after a DNS cleanup deleted the validation records ACM uses for that certificate. What should the team restore?
• New objects are encrypted with a new customer managed key. The old key was disabled before existing objects were re-encrypted, and reads of those older objects fail. Each old object still names the old key. What restores the reads?
• A public certificate requested through the default ACM path shows in the console that it cannot be exported. The team wanted that certificate installed on one EC2 web server. How should TLS for the site be terminated?
• A security review wants one place that shows this account's GuardDuty threat findings and Inspector vulnerability findings together. An operator opens only the GuardDuty console. What does that approach miss?
• Macie reports payment-card numbers in objects in a log bucket that several applications can read. The card data is not needed after the logs are reviewed, and those objects are not fetched through a website. What should change?
• GuardDuty raises a high-severity finding on an EC2 instance that is still running and still in the application security group. What should be done first?
• Amazon Inspector reports a critical CVE in packages on instances launched from a warehouse gold AMI. A teammate expects GuardDuty to scan that AMI and clear the CVE. What removes the finding's cause?
• A design studio must store a vendor license key encrypted at rest, and the key must not be rotated. The application can read a parameter when it starts. Which store meets both requirements?
• AWS Config marks a security group noncompliant because it allows a management port from anywhere. GuardDuty has no findings for the instances that use that group. What is the work?