Amazon Web ServicesAssociate levelSOA-C02Page 3 of 4

SOA-C02 exam dumps: questions 201 to 300 of 340

Page 3 of the free SOA-C02 question bank for the AWS Certified SysOps Administrator - Associate exam. Questions 201 to 300 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated December 2024

Start timed practice exam Questions 201 to 300

Free SOA-C02 practice questions

Questions 201 to 205 of 340

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

SOA-C02 Question 201

Select 2

Your organization has implemented a data classification scheme requiring resources to be tagged as 'Confidential', 'Internal', or 'Public'. You need to ensure that S3 buckets storing 'Confidential' data have server-side encryption enabled and are not publicly accessible. Which combination of actions should you take to enforce this policy?

A
Use AWS Config with a managed rule to check if S3 buckets with the 'Confidential' tag have server-side encryption enabled.
B
Enable S3 bucket versioning to protect data integrity for buckets tagged as 'Confidential'.
C
Use an S3 bucket policy to explicitly deny public access to buckets tagged as 'Confidential'.
D
Set up an AWS Lambda function triggered by S3 events to log access to buckets tagged as 'Confidential'.
E
Create an IAM policy that denies actions on S3 buckets tagged as 'Confidential' if they are not encrypted.

Show answer and explanation

Correct answers: A, C

Explanation

To enforce the data classification scheme, AWS Config can be used to monitor and ensure compliance with encryption policies, while an S3 bucket policy can enforce restrictions on public access. Together, these solutions address the requirements for buckets tagged as 'Confidential'.

A. Correct.
This is correct because AWS Config can monitor compliance with encryption requirements for S3 buckets based on defined tags like 'Confidential'.
B. Incorrect.
While versioning is a good practice, it does not directly enforce the required data classification scheme or ensure encryption or access restrictions.
C. Correct.
This is correct because an S3 bucket policy can explicitly deny public access to buckets tagged as 'Confidential', ensuring compliance with the classification scheme.
D. Incorrect.
Logging access is useful for auditing but does not enforce encryption or public access restrictions.
E. Incorrect.
IAM policies cannot enforce conditional encryption based on tags in the way described. AWS Config or bucket policies are better suited for this use case.

SOA-C02 Question 202

Select 3

Your company has implemented a data classification scheme with three levels: Confidential, Internal, and Public. You need to enforce this classification scheme for data stored in Amazon S3. Which actions should you take to ensure compliance with the scheme?

A
Use S3 bucket policies to deny access to data labeled 'Confidential' unless accessed from approved IAM roles.
B
Tag S3 objects with a 'DataClassification' key and values like 'Confidential', 'Internal', or 'Public'.
C
Enable S3 Object Lock to prevent deletion of objects classified as 'Internal' or 'Confidential'.
D
Configure AWS Config rules to ensure that all S3 buckets have default encryption enabled.
E
Set up Amazon Macie to automatically detect and classify sensitive data within S3 buckets.

Show answer and explanation

Correct answers: A, B, D

Explanation

To enforce a data classification scheme in Amazon S3, you need mechanisms to control access based on classification (e.g., bucket policies), track classification metadata (e.g., object tagging), and ensure compliance with security policies (e.g., encryption via AWS Config rules). While Amazon Macie and S3 Object Lock are helpful for security and data protection, they do not directly enforce your classification scheme.

A. Correct.
Using S3 bucket policies to deny access to specific data classifications ensures that access control is enforced based on your data classification scheme.
B. Correct.
Tagging objects with a 'DataClassification' key helps maintain metadata about the classification level of each object, enabling streamlined management and compliance.
C. Incorrect.
While S3 Object Lock prevents deletion or overwriting of objects, it is not directly related to enforcing a data classification scheme.
D. Correct.
AWS Config rules can be used to ensure that encryption is enabled for all S3 buckets, which aligns with protecting sensitive data classifications like 'Confidential'.
E. Incorrect.
Amazon Macie detects and classifies sensitive data, but it is a detection tool rather than an enforcement mechanism for a predefined data classification scheme.

SOA-C02 Question 203

Select 2

A company has implemented a data classification scheme to categorize its data into 'Confidential', 'Restricted', and 'Public'. They want to enforce this classification scheme across their AWS account to ensure that objects in Amazon S3 buckets are appropriately tagged and comply with the classification policy. Which combination of solutions should the SysOps administrator implement to meet this requirement?

A
Use AWS Config with a custom rule to check if S3 objects have the correct classification tags.
B
Enable S3 Object Lock to automatically enforce data classification on all objects.
C
Create an S3 bucket policy that requires all uploaded objects to include specific classification tags.
D
Use Amazon Macie to automatically classify and tag sensitive data stored in S3 buckets.
E
Set up an S3 Lifecycle policy to enforce tagging based on data classification rules.

Show answer and explanation

Correct answers: A, C

Explanation

To enforce a data classification scheme, AWS Config with a custom rule is suitable for checking compliance with tagging requirements, while an S3 bucket policy can enforce tagging by preventing non-compliant uploads. These solutions work together to ensure that the classification scheme is adhered to. Other options, like S3 Object Lock and Amazon Macie, do not directly enforce tagging or classification rules, and S3 Lifecycle policies are unrelated to tagging enforcement.

A. Correct.
AWS Config with a custom rule can evaluate whether S3 objects have the required tags, helping to enforce the data classification scheme.
B. Incorrect.
S3 Object Lock is designed to enforce WORM (Write Once, Read Many) protection and does not enforce tagging or classification policies.
C. Correct.
An S3 bucket policy can be used to enforce tagging by denying uploads of objects that do not include required tags, ensuring compliance with the classification scheme.
D. Incorrect.
Amazon Macie is a tool for discovering and identifying sensitive data, but it does not enforce tagging or apply pre-defined classification schemes directly.
E. Incorrect.
S3 Lifecycle policies are used for managing the lifecycle of objects, such as transitioning them to different storage classes or deleting them, but they do not enforce tagging or classification rules.

SOA-C02 Question 204

Select 3

Your company has recently implemented a data classification policy to categorize data as 'Confidential,' 'Internal,' and 'Public.' You are tasked with enforcing this classification policy for data stored in Amazon S3. Which combination of actions should you take to ensure the classification is consistently applied and monitored?

A
Use S3 bucket tags to apply classification labels like 'Confidential,' 'Internal,' and 'Public' to each bucket.
B
Implement S3 Object Tags to apply classification labels on individual objects within the buckets.
C
Set up an Amazon Macie job to automatically discover and classify sensitive data in your S3 buckets.
D
Use IAM policies to restrict access to buckets based on classification labels using condition keys for tags.
E
Enable S3 Versioning to track changes to objects and ensure data classification is preserved.

Show answer and explanation

Correct answers: B, C, D

Explanation

To enforce a data classification scheme in S3, you should apply classification labels at the object level using S3 Object Tags. Amazon Macie can help discover and classify sensitive data, while IAM policies can enforce access control based on those classification tags. These methods together ensure that the classification policy is consistently applied and monitored.

A. Incorrect.
Using S3 bucket tags for data classification is not specific enough, as classification often needs to be applied at the object level, not just the bucket level.
B. Correct.
S3 Object Tags allow you to label individual objects with classifications like 'Confidential,' making it a suitable option for enforcing data classification schemes.
C. Correct.
Amazon Macie can automatically discover and classify sensitive data, which helps ensure compliance with your data classification policy.
D. Correct.
IAM policies can leverage tags in condition keys to restrict or allow access based on data classification labels, enforcing the policy effectively.
E. Incorrect.
While S3 Versioning is useful for data recovery and tracking changes, it does not directly enforce or monitor data classification schemes.

SOA-C02 Question 205

Single answer

A company is using AWS Key Management Service (KMS) to encrypt sensitive data in an S3 bucket. The SysOps Administrator is tasked with ensuring that the encryption keys are rotated automatically to meet compliance requirements. What is the MOST effective way to achieve this using AWS KMS?

A
Enable automatic key rotation for the customer-managed key (CMK) in AWS KMS.
B
Manually create a new key in KMS every year and update the S3 bucket with the new key.
C
Use an AWS-managed key (AWS-KMS) as it rotates automatically without any configuration.
D
Configure an S3 bucket policy to automatically rotate KMS keys every 365 days.

Show answer and explanation

Correct answer: A

Explanation

To ensure compliance with encryption key rotation policies, enabling automatic key rotation for customer-managed keys (CMKs) in AWS KMS is the most efficient and reliable approach. This feature ensures keys are rotated automatically every year without requiring manual intervention, reducing the risk of human error.

A. Correct.
Correct: AWS KMS supports automatic key rotation for customer-managed keys (CMKs). Enabling this feature ensures compliance with key rotation policies without manual intervention.
B. Incorrect.
Incorrect: Manually creating and updating keys is prone to human error and does not meet the requirement for automation.
C. Incorrect.
Incorrect: While AWS-managed keys are automatically rotated, they cannot be managed or controlled directly by the customer, which may not meet compliance requirements for customer-managed keys.
D. Incorrect.
Incorrect: S3 bucket policies do not support automatic rotation of KMS keys. Key rotation must be configured within AWS KMS.

Timed practice exam

Take a SOA-C02 practice test under exam conditions

65 questions in 130 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

SOA-C02 practice questions 201 to 300 of 340

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 4 pages of up to 100 questions.

More AWS exam dumps

All AWS exams

AIF-C01230 questions

AWS Certified AI Practitioner exam dumps

AWS Certified AI Practitioner

ANS-C01512 questions

AWS Advanced Networking Specialty exam dumps

AWS Certified Advanced Networking - Specialty

CLF-C02341 questions

AWS Certified Cloud Practitioner exam dumps

AWS Certified Cloud Practitioner

DEA-C01549 questions

AWS Data Engineer Associate exam dumps

AWS Certified Data Engineer - Associate

DOP-C02410 questions

AWS DevOps Engineer Professional exam dumps

AWS Certified DevOps Engineer - Professional

DVA-C02398 questions

AWS Developer Associate exam dumps

AWS Certified Developer - Associate

MLS-C01388 questions

AWS Machine Learning Specialty exam dumps

AWS Certified Machine Learning - Specialty

MLA-C01457 questions

AWS Machine Learning Engineer Associate exam dumps

AWS Certified Machine Learning Engineer - Associate