A company uses AWS Organizations with multiple accounts. The security team needs a single, immutable record of all API activity across all accounts, including the management account. They want to ensure that users with high privileges cannot alter the log files. Which solution meets these requirements?

Create an organization trail in the management account that delivers logs to an S3 bucket with S3 Object Lock enabled in compliance mode.

Create a trail in each account and use AWS Config to aggregate the logs into a single S3 bucket.

Enable CloudTrail in the management account only and use SCPs to prevent other accounts from making API calls.

Enable CloudTrail in each account individually and store the logs in each account's own S3 bucket.

A financial services company must ensure that its data is processed and stored only within the European Union. Which AWS configuration should be used to meet this requirement?

Deploy resources in an EU Region, such as eu-west-1

AWSCertified CloudOps Engineer - Associate

Domain 4Objective 1

Task 4.1: Implement and Manage Security and Compliance Tools and Policies. SOA-C03 Practice Questions (Page 5)

Part of the Content Domain 4: Security and Compliance domain, which makes up ~17% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

16concepts

16 Concepts in This Objective

IAM Password Policies
Multi-Factor Authentication (MFA)
IAM Roles
Federated Identity
Resource Policies
Policy Conditions
AWS CloudTrail for Auditing
IAM Access Analyzer
IAM Policy Simulator
AWS Organizations
Service Control Policies (SCPs)
IAM Identity Center
Trusted Advisor Security Checks
Remediation Strategies
Region and Service Selection
AWS Config Conformance Packs

Questions 21–25

21foundation · easy
Which AWS tool allows you to test the effects of an IAM policy without actually making API calls?
Select an answer first
22application · medium
A company uses AWS Organizations with multiple accounts. The security team needs a single, immutable record of all API activity across all accounts, including the management account. They want to ensure that users with high privileges cannot alter the log files. Which solution meets these requirements?
Select an answer first
23foundation · easy
A financial services company must ensure that its data is processed and stored only within the European Union. Which AWS configuration should be used to meet this requirement?
Select an answer first
24foundation · easy
An organization wants to prevent IAM users from reusing their previous 5 passwords. Which IAM password policy setting should be configured?
Select an answer first
25foundation · easy
Which AWS service helps identify resources that are shared with external entities, such as an S3 bucket that is accessible to another AWS account?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SOA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SOA-C03” is a trademark of its owner, used for identification only.

Task 4.1: Implement and Manage Security and Compliance Tools and Policies. SOA-C03 Practice Questions (Page 5)

Questions 21–25

Which AWS tool allows you to test the effects of an IAM policy without actually making API calls?

A financial services company must ensure that its data is processed and stored only within the European Union. Which AWS configuration should be used to meet this requirement?

An organization wants to prevent IAM users from reusing their previous 5 passwords. Which IAM password policy setting should be configured?

Which AWS service helps identify resources that are shared with external entities, such as an S3 bucket that is accessible to another AWS account?

Keep studying — Content Domain 4: Security and Compliance