Implement and manage security and compliance tools and policies.
15 practice questions under this official exam objective (SOA-C03) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
Serving Private S3 Content with Least Administrative Effort
This question explores secure methods for serving private Amazon S3 objects, contrasting manual processes with automated solutions like CloudFront Ori
Avoiding Permanent Credentials with AWS STS
This question addresses how to secure SaaS applications by eliminating permanent IAM credentials in favor of temporary security tokens using AWS Secur
How Can Lambda Securely List EC2 Instances in Another Account?
This question tests how an AWS Lambda function in one account can securely read EC2 instance data from another account. The page establishes that scop
How to Block EC2 Launches in Unauthorized Regions Across an Organization?
An AWS Organizations service control policy attached at the root is the most operationally efficient way to deny ec2:RunInstances in unauthorized Regi
How to Rotate RDS Administrator Passwords Annually and Most Efficiently?
Amazon RDS administrator credentials must be rotated at least yearly, and AWS Secrets Manager has native, built-in rotation support for RDS databases.
How to Request an ACM Certificate for an App in Another AWS Account?
An ACM certificate must be requested in the development account where the application runs, while Route 53 DNS validation records can be created in th
How to log all S3 access and alert on delete events?
S3 server access logging captures every request made to a bucket, while S3 event notifications to Amazon SNS deliver near-real-time DeleteObject alert
How to Enforce S3 Bucket Versioning with AWS Config?
This SOA-C03 question tests enforcing Amazon S3 bucket versioning with an AWS Config managed rule and automatic remediation. The correct solution uses
How do you auto-remediate 0.0.0.0/0 security groups across AWS Organizations?
AWS Config detects security groups that allow inbound traffic from 0.0.0.0/0 and can trigger automatic remediation to replace that source with the com
Enforce EC2 CostCenter Tag via Organizations
Using AWS Organizations to enforce tag compliance prevents noncompliant EC2 launches centrally. This page explains why an Organizations policy is the
How to Apply a Base Configuration to New AWS Organizations Accounts?
AWS CloudFormation StackSets with automatic deployments applies a base configuration to accounts as they join AWS Organizations, without custom orches
How Do You Find Security Groups Open to the Internet on Port 3389?
AWS Trusted Advisor's security group check reports security groups whose inbound rules allow unrestricted access on ports such as 22 and 3389. This pa
How to Terminate EC2 Instances Missing Required Tags Efficiently?
This SOA-C03 question tests the most operationally efficient way to enforce required EC2 tags and terminate noncompliant instances. The answer is an A
How to Enforce S3 Bucket Tags and Policies with Self-Service Provisioning?
AWS Service Catalog products let an administrator preconfigure S3 bucket tags and restrictive bucket policies so development teams self-provision comp
Which Actions Does This IAM Policy Allow for a Developer?
This SOA-C03 question tests whether you can read an IAM policy's Action elements and map them to AWS API calls. It establishes that the policy permits