Task 4.1: Implement and Manage Security and Compliance Tools and Policies. SOA-C03 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company's AWS Trusted Advisor dashboard shows a red check for 'MFA on Root Account' in the security category. The root account is used only for rare administrative tasks. The security team wants to remediate this finding while minimizing operational friction. What should they do?

   • ADelete the root account and create a new IAM user with full administrative access.
   • BEnable MFA on the root account and store the MFA device with the security team for shared use.
   • CCreate an IAM role with AdministratorAccess and use it instead of the root account, then disable the root account.
   • DIgnore the finding because the root account is rarely used.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   After reviewing Trusted Advisor security findings, what is the next step to address the identified risks?

   • AImplement remediation actions
   • BIgnore the findings
   • CDisable Trusted Advisor
   • DDelete the affected resources
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company must ensure that all S3 buckets in its AWS account are encrypted with SSE-KMS and that all EBS volumes are encrypted. The security team wants a single mechanism to continuously monitor and enforce these rules across all current and future resources. Which solution should they use?

   • ACreate AWS Config rules and deploy them using a conformance pack.
   • BCreate IAM policies that deny the creation of unencrypted S3 buckets and EBS volumes.
   • CUse AWS CloudTrail to detect unencrypted resources and trigger a Lambda function to encrypt them.
   • DUse AWS Trusted Advisor to check for unencrypted resources and remediate them manually.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   According to AWS best practices, which AWS account should have MFA enabled as a mandatory security measure?

   • AOnly the root user account
   • BOnly IAM users with console access
   • COnly IAM users with administrative permissions
   • DThe root user account and all IAM users
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security engineer runs IAM Access Analyzer and receives a finding that an SQS queue is accessible by an external AWS account. The engineer needs to determine if this is a legitimate sharing arrangement. What should they do FIRST?

   • AUse the IAM Policy Simulator to test the queue's policy.
   • BDelete the queue's access policy immediately.
   • CReview the queue's access policy to see which actions are allowed for the external account.
   • DCreate an AWS Config rule to monitor the queue.
   Reveal Solution Discussion Select an answer first