AWS CloudOps Engineer – Associate (SOA-C03): 5 Practice Questions on Security and Compliance

Here are 5 SOA-C03 practice questions on Security and Compliance. It carries about 16% of the exam score. Each answer explains the correct choice and what is wrong with the others.

AWS CloudOps Engineer – Associate (SOA-C03) · Security and Compliance · 5 questions with answers and explanations

📊 This set at a glance

Exam: SOA-C03 · 65 questions · 130 minutes · passing score 720
This set: 3 advanced, 2 applied · 3 scenario, 1 trade-off, 1 troubleshooting · 2 with more than one answer
Topics: AWS Certificate Manager, Elastic Load Balancing, AWS IAM Access Analyzer, AWS Organizations, AWS IAM, AWS Shield, AWS KMS, Amazon S3

Question 1 of 5

Which TWO actions protect data in transit to an ALB-hosted application? (Select TWO)

AEnable S3 versioning on the log bucket

BAllow only port 80 in the security group

CStore the TLS private key in user data

DUse an HTTPS listener with an ACM certificate

ERedirect HTTP requests to HTTPS on the listener

Show answer

✅ Answer: D, E

Difficulty: applied · Topic: AWS Certificate Manager, Elastic Load Balancing

Encryption in transit to an ALB
Data in transit is protected with TLS. On an Application Load Balancer that means an HTTPS listener on port 443:
• The listener needs a certificate. AWS Certificate Manager (ACM) issues public certificates at no charge, renews them automatically and deploys them to the ALB, so the private key is never handled by people.
• A security policy on the listener controls which TLS versions and ciphers clients may use, for example a policy that allows only TLS 1.2 and later.

Enforcing HTTPS
Clients may still type http://. Keep a listener on port 80 whose default action is a redirect to HTTPS on port 443 with status code HTTP_301. The browser follows it, and all application data then travels encrypted.
If the back end also needs encryption, the target group can use HTTPS to the instances as well.

Why each option works or fails
• ✗ A. S3 versioning on the log bucket: versioning keeps old object versions for recovery; it has nothing to do with traffic between users and the ALB.
• ✗ B. Allow only port 80: port 80 carries plain HTTP, so allowing only it would guarantee unencrypted traffic.
• ✗ C. TLS private key in user data: user data is readable from the instance metadata service and by anyone who can view the instance attributes, so this exposes the key; ACM manages the key securely instead.
• ✓ D. HTTPS listener with an ACM certificate (correct): the listener terminates TLS with a managed certificate, so traffic between clients and the ALB is encrypted.
• ✓ E. Redirect HTTP to HTTPS (correct): a redirect action on the port 80 listener sends every plain HTTP request to the HTTPS listener, so no session stays unencrypted.

Question 2 of 5

A security team wants to reduce standing permissions across the 50 accounts of its organization. It needs a continuously updated list of IAM roles that have not been used for 90 days, and of roles that were granted services or actions they have never called, without building its own analysis. What should the CloudOps engineer set up?

ACreate an IAM Access Analyzer external access analyzer with the organization as the zone of trust and review its findings for unused roles

BCreate an IAM Access Analyzer unused access analyzer for the organization with a tracking period of 90 days and review its findings

CEnable AWS Trusted Advisor checks in every account and filter the IAM checks for roles that have been inactive for more than 90 days

DDownload the IAM credential report from every account each week and compare the password and access key last-used columns against the 90-day limit

Show answer

✅ Answer: B

Difficulty: applied · Topic: AWS IAM Access Analyzer, AWS Organizations, AWS IAM

Two kinds of IAM Access Analyzer
• External access analyzer: finds resources (buckets, keys, roles, queues) that grant access to principals outside a zone of trust such as the organization.
• Unused access analyzer: finds access that is granted but not used.

What unused access findings cover
• Unused roles: no activity within the tracking period
• Unused access keys and console passwords of IAM users
• Unused permissions: services and, for many services, actions the role is allowed but never called
Example finding: role etl-legacy allows s3:*, dynamodb:* and sqs:*, but only s3:GetObject was used in 90 days.

How to use it
Create it in the management account or a delegated administrator account with the organization as its scope. Findings can go to Security Hub or EventBridge, and Access Analyzer can also generate a policy from CloudTrail activity to replace a broad one. Unused access analysis is billed per role or user analyzed per month.

Why each option works or fails
• ✗ A. External access analyzer: this analyzer finds resources shared with principals outside the zone of trust. It does not analyze whether roles or permissions are used.
• ✓ B. Unused access analyzer (correct): an organization-level unused access analyzer continuously reports unused roles, unused access keys and passwords, and unused service- and action-level permissions for all member accounts, using the tracking period you set, such as 90 days. Findings appear in one place and update as activity changes.
• ✗ C. Trusted Advisor: Trusted Advisor has checks such as root MFA and exposed keys, but it does not produce per-role unused permission findings across an organization.
• ✗ D. Credential report: it covers IAM users' passwords and access keys only, one account at a time. It lists no roles and says nothing about unused permissions.

Question 3 of 5

A company wants to protect its public web application from large DDoS attacks, with access to the AWS response team and cost protection. Which service fits?

AAWS Shield Advanced

BAWS Shield Standard

CNetwork ACLs only

DSecurity groups only

Show answer

✅ Answer: A

Difficulty: advanced · Topic: AWS Shield

Shield Standard versus Shield Advanced
AWS Shield Standard is automatic and free for all AWS customers. It defends against common network and transport layer (layer 3/4) DDoS attacks on services such as CloudFront, Route 53 and Elastic Load Balancing.
AWS Shield Advanced is a paid subscription that you apply to specific resources (CloudFront distributions, Route 53 hosted zones, Global Accelerator accelerators, Application and Classic Load Balancers, Elastic IP addresses). It adds:
• Enhanced detection and mitigation, including application layer (layer 7) help together with AWS WAF.
• Access to the Shield Response Team (SRT), which can help analyze an attack and write mitigations.
• Cost protection: credits for scaling charges (for example extra CloudFront or EC2 usage) caused by a DDoS attack.
• Attack visibility, metrics and diagnostics, and proactive engagement options.
Example: an e-commerce site behind CloudFront and an ALB subscribes to Shield Advanced, adds both resources as protected resources, and associates a WAF web ACL for layer 7 rules.

Why each option works or fails
• ✓ A. Shield Advanced (correct): it is the only choice that includes response-team access and DDoS cost protection on top of stronger detection and mitigation for large attacks.
• ✗ B. Shield Standard: it gives baseline layer 3/4 protection at no cost, but it includes neither SRT access nor cost protection, which the requirement asks for.
• ✗ C. Network ACLs only: NACLs are stateless subnet filters with a limited number of rules. A volumetric attack can overwhelm resources before any rule helps, and they add no response team or cost protection.
• ✗ D. Security groups only: security groups allow traffic to instances; they cannot absorb a flood of traffic from many sources or provide DDoS expertise or cost credits.

Question 4 of 5

An application in us-east-1 encrypts records client side with AWS KMS before writing the ciphertext to S3, which replicates it to eu-west-1. During a Regional outage, the recovery stack in eu-west-1 must decrypt that data without calling us-east-1. The current key is a single-Region customer managed key. What should the CloudOps engineer do?

ACreate a multi-Region primary key in us-east-1 and a replica in eu-west-1, and switch the application to encrypt new data with the primary key

BCreate a new customer managed key in eu-west-1 and have the application encrypt every record twice, once with each key, and store both ciphertexts

CKeep the current key and create a KMS grant for the recovery role in eu-west-1 so that it can call Decrypt on the us-east-1 key during an outage

DConvert the existing single-Region key into a multi-Region key and create a replica in eu-west-1 that shares its key material and its key ID

Show answer

✅ Answer: A

Difficulty: advanced · Topic: AWS KMS, Amazon S3

Single-Region versus multi-Region KMS keys
A normal KMS key exists in one Region, and its key material never leaves that Region. Ciphertext it produces can only be decrypted by calling KMS in that Region.

Multi-Region keys
• You create a primary key with MultiRegion=true, then replica keys in other Regions.
• Primary and replicas share key material and the same key ID (mrk-...), with different Region in the ARN.
• Each has its own key policy, grants and aliases.
• Ciphertext from one can be decrypted by any related key, locally.

Limits to remember
• The multi-Region property is chosen at creation and cannot be changed later.
• Data encrypted with the old single-Region key must be re-encrypted to become decryptable in the other Region.
Common uses: DR for client-side encryption, DynamoDB global tables with client-side encryption, and signing across Regions.

Why each option works or fails
• ✓ A. Multi-Region keys (correct): a multi-Region primary and its replica share the same key material and key ID, so ciphertext produced in us-east-1 can be decrypted by the replica in eu-west-1 with a local API call. Existing single-Region keys cannot be converted, so the team creates a new multi-Region key, uses it for new data, and re-encrypts older data if it must be recoverable too.
• ✗ B. Encrypt twice with two keys: it can work but doubles storage and KMS calls and complicates the application, while multi-Region keys solve the problem natively.
• ✗ C. Grant on the existing key: a grant adds permissions but the key still lives only in us-east-1, so every decrypt call still has to reach us-east-1, which is unavailable during the outage.
• ✗ D. Convert the existing key: KMS does not allow converting a single-Region key to a multi-Region key; the multi-Region property is fixed when the key is created.

Question 5 of 5

An S3 bucket in account A stores reports encrypted with SSE-KMS using a customer managed key in account A. An analytics role in account B has an identity policy allowing s3:GetObject on the bucket and kms:Decrypt on the key ARN, but its GetObject requests fail with AccessDenied. The key type must not change. Which TWO changes in account A are required? (Select TWO)

AChange the bucket's default encryption to the AWS managed key aws/s3 so that the analytics role can decrypt the objects

BTurn off S3 Block Public Access on the bucket so that requests from principals in another account are no longer rejected

CAdd a statement to the key policy of the customer managed key that allows kms:Decrypt for the analytics role or account B

DCreate an S3 gateway endpoint in account A so that requests from account B reach the bucket through a private network path

EAdd a statement to the bucket policy that allows s3:GetObject on the report objects for the analytics role ARN in account B

Show answer

✅ Answer: C, E

Difficulty: advanced · Topic: Amazon S3, AWS KMS, AWS IAM

Cross-account access needs both sides
When a principal in account B calls a resource in account A, AWS requires an allow in both accounts:
• Account B: an identity policy on the role.
• Account A: a resource policy that trusts the role or account B.

SSE-KMS adds a second resource
For an object encrypted with SSE-KMS, GetObject makes S3 call KMS Decrypt on behalf of the caller. So the caller also needs:
• kms:Decrypt in its identity policy (already there in this case), and
• a statement in the key policy in account A, for example principal arn:aws:iam::222233334444:role/analytics.

Troubleshooting order
1. Bucket policy allows the principal?
2. Key policy allows the principal?
3. Identity policy allows both?
AWS managed keys cannot be shared across accounts, which is one reason to use customer managed keys for shared data.

Why each option works or fails
• ✗ A. AWS managed key: the key policy of an AWS managed key such as aws/s3 cannot be edited and only trusts the owning account, so cross-account reads would fail entirely. The requirement also forbids changing the key type.
• ✗ B. Block Public Access: granting a specific principal ARN in another account is not public access, so Block Public Access does not block it and does not need to be turned off.
• ✓ C. Key policy grant (correct): S3 decrypts SSE-KMS objects with the caller's permissions on the key, and a KMS key only accepts cross-account use if its key policy allows it, so the key policy must allow kms:Decrypt for the role or account B.
• ✗ D. Gateway endpoint in account A: an endpoint in account A does not carry account B's traffic and does not add permissions. The problem is authorization, not network path.
• ✓ E. Bucket policy grant (correct): cross-account access needs permission on both sides. Account B's identity policy is already in place, so the bucket owner must also allow the role for s3:GetObject in the bucket policy.

🎯 Key ideas from this set

• Protect data in transit to an ALB by serving HTTPS with an ACM certificate and redirecting HTTP to HTTPS.
• Unused roles and permissions → Access Analyzer unused access analyzer; external access analyzers and credential reports answer different questions.
• Free baseline DDoS defense is Shield Standard; response team plus cost protection means Shield Advanced.
• Decrypt in another Region without cross-Region calls → multi-Region primary and replica keys, created new because single-Region keys cannot be converted.
• Cross-account SSE-KMS reads need three allows: the caller's identity policy, the bucket policy, and the customer managed key's key policy.

🔗 Keep practicing on this blog

• SOA-C03 Practice Set: Reliability and Business Continuity
• SOA-C03 Practice Set: Security and Compliance
• All SOA-C03 practice sets
• Every exam on this blog

📚 More SOA-C03 practice

More SOA-C03 questions: https://hyunhp.github.io/cert-bank/#exam=SOA-C03
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=SOA-C03

These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.

Original practice questions written for this blog, not exam dumps.