Security and Compliance — AWS Certified CloudOps Engineer SOA-C03 practice questions

A team must rotate an RDS database password on a defined schedule without downtime or manual coordination between security and app teams.

1. Publish the password in a private S3 bucket and rely on lifecycle rules to age it out here
2. Save the password as an SSM Parameter Store SecureString and rotate it via a shell script
3. Embed the password in AWS Systems Manager State Manager associations for each rotation
4. Store the credential in AWS Secrets Manager with rotation via a managed Lambda rotator

Answer: D — Store the credential in AWS Secrets Manager with rotation via a managed Lambda rotator

A) S3 is not a credential store. B) Parameter Store does not natively rotate RDS credentials. C) State Manager is for configuration, not credentials. D) Correct - Secrets Manager supports managed RDS credential rotation.

A conformance framework requires evaluating every S3 bucket against ten separate rules and applying automated remediation when noncompliance appears.

1. Use CloudFormation StackSets to create a set of Lambda functions per rule instead
2. Author ten independent Config rules and manually run remediation via a runbook
3. Deploy an AWS Config conformance pack that groups rules and remediation actions
4. Turn on Security Hub, which will automatically enforce every S3 CIS-mapped control

Answer: C — Deploy an AWS Config conformance pack that groups rules and remediation actions

A) Reinvents rules infrastructure. B) Loses the packaged deployment. C) Correct — conformance packs bundle Config rules + remediation as a deployable unit. D) Security Hub reports findings, does not remediate.

A workload's IAM role should assume only a specific role in a target account and no other roles in any account or partition.

1. Grant sts:* on all resources and rely on the target account's trust policy to enforce scope
2. Attach the AWS-managed IAMFullAccess policy so the role has flexibility during operations
3. Scope sts:AssumeRole to the exact target role ARN in the source role's permissions policy
4. Configure a permissions boundary that lists every ARN the source role should not assume

Answer: C — Scope sts:AssumeRole to the exact target role ARN in the source role's permissions policy

A) Over-permissive at source. B) Way over-permissive. C) Correct - resource-scoped AssumeRole is the least-privilege pattern. D) Boundaries are ceilings; identity policy is still over-permissive.

A public web endpoint has been targeted by volumetric DDoS. The security team wants 24/7 DDoS response support and CloudFront + Route 53 protection at scale.

1. Rely on AWS Shield Standard, which is automatically enabled at no cost
2. Attach an AWS WAF web ACL with rate-based rules to throttle attackers
3. Subscribe to AWS Shield Advanced to unlock the Shield Response Team access
4. Enable GuardDuty and let its threat intelligence block source addresses

Answer: C — Subscribe to AWS Shield Advanced to unlock the Shield Response Team access

A) Standard gives baseline protection but no SRT or cost protection. B) Half-right — WAF helps at Layer 7 but does not include SRT support. C) Correct — Shield Advanced adds SRT support, cost protection, and enhanced diagnostics. D) GuardDuty detects threats but does not mitigate DDoS.

A team wants automatic remediation when a Config rule flags a public S3 bucket without waiting for manual triage from security.

1. Rely on S3 Block Public Access at account level to prevent the rule from ever tripping here
2. Author a CloudTrail-driven Lambda that watches PutBucketAcl and reverts every change too
3. Configure Security Hub to auto-remediate CIS findings across the entire organization now
4. Attach an SSM Automation document as the auto-remediation action on the Config rule now

Answer: D — Attach an SSM Automation document as the auto-remediation action on the Config rule now

A) Half-right prevention but not remediation of existing. B) Reinvents Config remediation. C) Security Hub aggregates, does not auto-remediate at rule level. D) Correct - Config rule auto-remediation via SSM Automation is the native mechanism.

An IAM user needs read-only access to a single S3 bucket without any additional actions or resources beyond that specific bucket.

1. Grant s3:GetObject and s3:ListBucket on the bucket ARN and object ARNs only ever
2. Attach the AWS-managed AmazonS3ReadOnlyAccess policy to the IAM user directly here
3. Add ReadOnlyAccess AWS-managed policy so the identity gets a broad read scope now
4. Configure a permissions boundary that restricts the user to the bucket namespace only

Answer: A — Grant s3:GetObject and s3:ListBucket on the bucket ARN and object ARNs only ever

A) Correct - scope the actions AND the resource ARN for least privilege. B) Grants all buckets, not one. C) Grants far beyond S3. D) Boundaries limit ceiling but the identity policy itself is over-permissive.

A compliance team wants one deployable bundle of Config rules + remediation actions enforcing a security baseline (encryption, public-access blocks, MFA) across every account in an OU, versioned as a single unit. What SOA-C03 Domain 4 feature fits?

1. A Config aggregator collecting findings from every account into one dashboard
2. A Config conformance pack deployed via StackSets to the target OU
3. An individual Config rule created separately in each of the 40 accounts by script
4. AWS Security Hub's consolidated findings view, configured per account

Answer: B — A Config conformance pack deployed via StackSets to the target OU

A) An aggregator only collects/views existing findings — it doesn't deploy or bundle rules. B) Correct — a conformance pack bundles multiple Config rules + remediation actions as one versioned, deployable unit, and StackSets rolls it out org-wide. C) Works but is exactly the unversioned, unbundled, per-account repetition the requirement asks to avoid. D) Security Hub aggregates findings from multiple sources; it doesn't define or deploy the underlying Config rule bundle itself.

An operations team must rotate a customer-managed KMS key annually without changing the key ID that applications reference in code and configuration.

1. Attach a key policy that blocks Decrypt calls after 365 days from creation time
2. Manually create a new KMS key each year and update all application references
3. Import external key material and re-import every 365 days from a hardware module
4. Enable automatic key rotation on the customer-managed KMS symmetric key each year

Answer: D — Enable automatic key rotation on the customer-managed KMS symmetric key each year

A) Blocks access, doesn't rotate material. B) Breaks references. C) Import path doesn't auto-rotate. D) Correct — customer-managed KMS keys support automatic annual rotation; key ID stays the same.

An org must enforce that no IAM user can create access keys older than 90 days across all member accounts as a preventive guardrail.

1. Author a Lambda that scans IAM and deactivates old keys every night through the API here
2. Configure IAM Access Analyzer to warn on old access keys via monthly reports for review
3. Attach an SCP that denies iam:CreateAccessKey after certain conditions in every account
4. Rely on Trusted Advisor's IAM key rotation check to notify the account owner via email

Answer: A — Author a Lambda that scans IAM and deactivates old keys every night through the API here

A) Correct - Lambda-based scheduled remediation deactivates keys past age (with an SCP layer for defense-in-depth). B) Advisory only. C) Half-right - SCPs are the preventive layer, but there is no direct SCP condition on key age. D) Trusted Advisor is advisory.

A team must detect and stop leaked IAM access keys automatically within minutes of the key appearing in a public code repository or on the dark web.

1. Enable IAM Access Analyzer with GuardDuty findings for anomalous credential use
2. Rely on CloudTrail queries to detect logins from unusual regions after the fact
3. Configure MFA on every IAM user and rotate their access keys once every year
4. Turn on GuardDuty and act on findings such as ExposedCredentials via automation

Answer: D — Turn on GuardDuty and act on findings such as ExposedCredentials via automation

A) Half-right — Access Analyzer flags cross-account exposures, not key leaks. B) Reactive, not automatic. C) MFA doesn't protect leaked programmatic keys. D) Correct — GuardDuty detects exposed credentials and remediation can auto-disable them.

AWS Macie?

Discovers PII in S3. Reports sensitive data findings.

Config conformance pack?

Bundle of Config rules + remediation actions. Reusable across accounts.

Service Control Policies (SCPs)?

Org-level guardrails. Limit what accounts/OUs can do. Apply via Organizations.

Control Tower?

Sets up and governs multi-account environment. Pre-configured guardrails.