SOA-C03 Practice Set: Security and Compliance
Security and Compliance is a recurring theme in the AWS CloudOps Engineer – Associate (SOA-C03) exam. It makes up about 16% of the exam. The 5 questions below come with a full explanation of why each option is right or wrong.
AWS CloudOps Engineer – Associate (SOA-C03) · Security and Compliance · 5 questions with answers and explanations
🧭 Before you start
Security operations questions name a goal and a scope: stop even administrators from turning off logging, find card numbers in S3, list resources shared outside the organization, give an application credentials, serve traffic over HTTPS, or let a VPC function reach an AWS API. The task is to pick the control type that fits (preventive, detective or corrective) and confirm that every layer which must allow access does so.
Keep in mind
• Constraints that must bind administrators in member accounts come from organization policies, not from IAM policies inside those accounts or from alarms after the fact.
• Know what each finding service looks at: data content in S3 buckets, threats seen in activity, or resource policies that grant external or unused access.
• For cross-account reads of SSE-KMS objects, count every policy that must allow the request, and remember that a VPC function with no internet path still needs a route to the AWS APIs it calls.
📊 Set profile
Exam: SOA-C03 · 65 questions · 130 minutes · passing score 720
This set: 3 advanced, 2 applied · 4 scenario, 1 troubleshooting
Topics: AWS Organizations, Amazon Macie, IAM Access Analyzer, AWS IAM, AWS Secrets Manager, AWS Lambda, Amazon VPC
Question 1 of 5
A company must prevent member accounts from disabling CloudTrail, even with administrator permissions. Which control fits?
Show answer
✅ Answer: A
Difficulty: applied · Topic: AWS Organizations
Service control policies
A service control policy (SCP) is an AWS Organizations policy attached to the root, an OU or an account. It defines the maximum permissions available to IAM users and roles in member accounts.
• An action denied by an SCP cannot be performed by any user or role in that account, including one with AdministratorAccess, because the effective permission is the intersection of the SCP and the identity policy.
• SCPs do not grant anything; they only limit.
• SCPs do not restrict the management account.
Example
An SCP with "Effect": "Deny" on cloudtrail:StopLogging, cloudtrail:DeleteTrail and often cloudtrail:UpdateTrail and cloudtrail:PutEventSelectors, attached to the OU, stops any member account from turning off or weakening its trail. A condition can exempt a dedicated security role if needed.
An organization trail created from the management account is also protected, because member accounts cannot modify it.
Why each option works or fails
• ✓ A. SCP denying StopLogging and DeleteTrail (correct): SCPs cap permissions for everyone in member accounts, so even account administrators cannot perform the denied CloudTrail actions.
• ✗ B. Tag on the trail: a tag is only metadata; it enforces nothing unless a policy references it, and an administrator can remove the tag.
• ✗ C. IAM policy on the developers group: an account administrator can edit or detach that policy, or act through a role outside the group, so it does not bind administrators.
• ✗ D. CloudWatch alarm on logging stopping: an alarm detects the change after it happens; it does not prevent it, and there is a gap in logging until someone reacts.
🎯 Key idea: To stop even administrators in member accounts from doing something, use a deny in an SCP; IAM policies and alarms do not constrain the account's own admins.
Question 2 of 5
A company must find sensitive data such as credit card numbers stored in S3 across many buckets. Which service fits?
Show answer
✅ Answer: B
Difficulty: applied · Topic: Amazon Macie
What Amazon Macie does
Amazon Macie discovers and classifies sensitive data in Amazon S3. It first builds an inventory of your buckets, reporting ones that are public, shared or unencrypted, and then inspects object contents.
• Managed data identifiers detect types such as credit card numbers, bank account numbers, passport numbers and personal names and addresses, across many countries and formats.
• Custom data identifiers use a regular expression plus keywords for your own formats, such as internal customer IDs.
• Automated sensitive data discovery samples objects across the estate continuously; sensitive data discovery jobs scan chosen buckets fully, once or on a schedule.
Example
A job over 200 buckets reports that s3://exports-archive/2025/payments.csv contains credit card numbers. The finding goes to EventBridge and Security Hub so the team can restrict or clean up the object.
Macie supports multi-account management with a delegated administrator.
Why each option works or fails
• ✗ A. Amazon GuardDuty: GuardDuty detects threats such as suspicious API calls or anomalous S3 access patterns; it does not read object contents to find card numbers.
• ✓ B. Amazon Macie (correct): it scans S3 objects with managed data identifiers that recognize credit card numbers and other sensitive data across many buckets and accounts.
• ✗ C. AWS Resource Access Manager: RAM shares resources such as subnets or transit gateways between accounts and does not inspect data.
• ✗ D. AWS Firewall Manager: Firewall Manager centrally applies WAF rules, security groups and network firewall policies across accounts; it has nothing to do with data classification.
🎯 Key idea: Finding sensitive data such as card numbers inside S3 objects is Macie's job; GuardDuty looks for threats, not content.
Question 3 of 5
The team wants continuous findings for any S3 bucket, KMS key, or IAM role that grants access to principals outside its AWS Organization. Which service fits?
Show answer
✅ Answer: C
Difficulty: advanced · Topic: IAM Access Analyzer
What IAM Access Analyzer checks
Many AWS resources carry a resource-based policy: an S3 bucket policy, a KMS key policy, an IAM role trust policy, and others such as SQS queues, Lambda functions and Secrets Manager secrets. Such a policy can grant access to another account, even one outside your company.
IAM Access Analyzer (external access analyzer) uses automated reasoning to read these policies and work out who can reach each resource. You choose a zone of trust: your account or your whole AWS Organization.
• Any access granted to a principal outside the zone of trust becomes a finding, for example a role trust policy that lets arn:aws:iam::999999999999:root assume it.
• Analysis is continuous: when a policy changes, the resource is re-analyzed and findings are created or resolved.
• Findings you expect can be archived with archive rules; findings also flow to EventBridge for automation.
Why each option works or fails
• ✗ A. GuardDuty unusual S3 API findings: GuardDuty watches activity such as anomalous data access; it does not read policies, and it has no view of who a KMS key policy or role trust policy allows.
• ✗ B. Macie public-bucket findings: Macie discovers sensitive data in S3 and summarizes bucket posture, but it covers S3 only and does not evaluate KMS keys or IAM role trust policies against an organization boundary.
• ✓ C. (correct): IAM Access Analyzer with the organization as the zone of trust: it analyzes S3 bucket, KMS key and IAM role policies (and more) and continuously reports every resource shared with principals outside the organization.
• ✗ D. Trusted Advisor S3 permissions check: flags buckets with open (public) access; it does not cover KMS keys or IAM roles and does not distinguish access by specific external accounts from access inside the organization.
🎯 Key idea: "Who outside my organization can access this resource?" is answered from policies by Access Analyzer, not from activity by GuardDuty or from data scans by Macie.
Question 4 of 5
An application on EC2 needs to read from a DynamoDB table. What is the most secure way to give it credentials?
Show answer
✅ Answer: B
Difficulty: advanced · Topic: AWS IAM
Giving AWS credentials to code on EC2
An application on EC2 should never carry long-term keys. Instead:
• Create an IAM role that EC2 can assume, with a least-privilege policy, for example dynamodb:GetItem and dynamodb:Query on arn:aws:dynamodb:us-east-1:111122223333:table/Orders.
• Attach it through an instance profile (the container that links a role to an instance).
• The AWS SDKs automatically fetch temporary credentials from the instance metadata service (preferably IMDSv2) and refresh them before they expire.
Nothing secret is stored on disk or in code, credentials rotate automatically, and access can be changed or revoked by editing the role.
Why each option works or fails
• ✗ A. Access keys in a config file: long-term keys can leak through backups, images or repositories and must be rotated by hand.
• ✓ B. IAM role through an instance profile (correct): the application gets short-lived, auto-rotated credentials scoped to the table without storing any secret.
• ✗ C. Root user access keys: root has unrestricted access to the whole account and should have no access keys at all; exposing them risks the entire account.
• ✗ D. Shared IAM user password in code: passwords sign in to the console, not SDK calls, and a hard-coded shared secret is both insecure and unattributable.
🎯 Key idea: EC2 applications get AWS access from an IAM role via an instance profile; any stored key or password is a leak waiting to happen.
Question 5 of 5
A Lambda function in a VPC with no internet access and no NAT gateway rotates a database secret in AWS Secrets Manager. Rotation started, but it keeps failing in the createSecret step with a timeout when the function calls the Secrets Manager API. What should be done?
Show answer
✅ Answer: A
Difficulty: advanced · Topic: AWS Secrets Manager, AWS Lambda, Amazon VPC
Where the rotation function runs
Secrets Manager invokes a Lambda function for rotation. If the database is in a private subnet, the function is attached to the VPC. That places its network interfaces in your subnets, so its calls no longer have the default internet access.
Two network paths
1. To the database, over the VPC.
2. To the Secrets Manager API, via NAT gateway or an interface VPC endpoint (com.amazonaws.<region>.secretsmanager).
Why each option works or fails
• ✓ A. Interface endpoint (correct): a rotation function in a VPC needs to reach the Secrets Manager API as well as the database. Without a NAT gateway or internet route, an interface VPC endpoint provides the private path, and the endpoint's security group has to allow inbound 443 from the function.
• ✗ B. Longer timeout: the calls never reach the service, so more time does not change the result.
• ✗ C. Public subnet: the failing call is to the Secrets Manager API, not to the database, and public exposure of the database would weaken security.
• ✗ D. S3 gateway endpoint: Secrets Manager does not expose its state through S3 for the function.
🎯 Key idea: A VPC-attached rotation function needs a route to the Secrets Manager API, typically an interface VPC endpoint, as well as to the database.
🔗 Related practice sets
• SOA-C03 Practice Set: Reliability and Business Continuity
• All SOA-C03 practice sets
• Every exam on this blog
📚 More SOA-C03 practice
More SOA-C03 questions: https://hyunhp.github.io/cert-bank/#exam=SOA-C03
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=SOA-C03
These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.
Original practice questions written for this blog, not exam dumps.
Comments
Post a Comment