Exams / SOA-C03 / Auditing and troubleshooting access / Question 2
SOA-C03 practice question: Auditing and troubleshooting access (2 of 2)
Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
An esports league has 25 AWS accounts in one AWS Organization. After a contractor left, the security team wants a continuous list of every IAM role, S3 bucket, KMS key and Lambda function in any account whose resource-based policy grants access to a principal outside the organization. New resources must be checked automatically. What should a CloudOps engineer set up with the LEAST effort?
Choose one answer.
- AA. Amazon Macie in every account, with a weekly sensitive data discovery job across all S3 buckets.
- BB. The IAM policy simulator, run weekly against every role and resource policy in each account by a scheduled script.
- CC. An IAM Access Analyzer analyzer with the organization as its zone of trust, in a delegated admin account.
- DD. The Trusted Advisor security checks in every account, reviewed by the security team at the start of each week.
Show the answer and explanation
Answer: C
Explanation
IAM Access Analyzer uses automated reasoning to find resources whose policies grant access outside a zone of trust. With the organization as the zone of trust, one analyzer covers every member account and keeps findings current as policies change. Macie, the policy simulator and Trusted Advisor answer different questions.
Study
Keep practicing
Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.