A company that operates in the European Union must ensure that all personal data is stored in AWS Regions within the EU. The security team wants to enforce this for all future resource creation across all accounts in their organization. Which approach should they use?

Use Trusted Advisor to check for resources in non-EU Regions.

Use an SCP that denies all actions in non-EU Regions.

Use AWS Config to detect resources in non-EU Regions and delete them.

Use IAM Identity Center to restrict user access to EU Regions only.

AWSCertified CloudOps Engineer - Associate

Domain 4Objective 1

Task 4.1: Implement and Manage Security and Compliance Tools and Policies. SOA-C03 Practice Questions (Page 2)

Part of the Content Domain 4: Security and Compliance domain, which makes up ~17% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

16concepts

16 Concepts in This Objective

IAM Password Policies
Multi-Factor Authentication (MFA)
IAM Roles
Federated Identity
Resource Policies
Policy Conditions
AWS CloudTrail for Auditing
IAM Access Analyzer
IAM Policy Simulator
AWS Organizations
Service Control Policies (SCPs)
IAM Identity Center
Trusted Advisor Security Checks
Remediation Strategies
Region and Service Selection
AWS Config Conformance Packs

Questions 6–10

6application · medium
A company that operates in the European Union must ensure that all personal data is stored in AWS Regions within the EU. The security team wants to enforce this for all future resource creation across all accounts in their organization. Which approach should they use?
Select an answer first
7foundation · easy
A company requires that all IAM users change their passwords every 90 days and that passwords be at least 12 characters long. Which AWS feature should be used to enforce these requirements?
Select an answer first
8foundation · easy
A company must store data only in a specific geographic location to comply with data residency regulations. Which AWS decision is most directly affected by this requirement?
Select an answer first
9foundation · easy
Which type of policy is attached directly to an AWS resource, such as an S3 bucket or an SQS queue, to define who can access that resource?
Select an answer first
10foundation · easy
Which AWS service is used to manage single sign-on (SSO) and federated access across multiple AWS accounts and business applications?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SOA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SOA-C03” is a trademark of its owner, used for identification only.

Task 4.1: Implement and Manage Security and Compliance Tools and Policies. SOA-C03 Practice Questions (Page 2)

Questions 6–10

A company that operates in the European Union must ensure that all personal data is stored in AWS Regions within the EU. The security team wants to enforce this for all future resource creation across all accounts in their organization. Which approach should they use?

A company requires that all IAM users change their passwords every 90 days and that passwords be at least 12 characters long. Which AWS feature should be used to enforce these requirements?

A company must store data only in a specific geographic location to comply with data residency regulations. Which AWS decision is most directly affected by this requirement?

Which type of policy is attached directly to an AWS resource, such as an S3 bucket or an SQS queue, to define who can access that resource?

Which AWS service is used to manage single sign-on (SSO) and federated access across multiple AWS accounts and business applications?

Keep studying — Content Domain 4: Security and Compliance