DOP-C02 Mock Exam 75 — 25 Questions

Question 1

A company is using AWS Secrets Manager to rotate database credentials automatically. The DevOps engineer needs to ensure that the rotation process is secure and does not cause downtime. Which THREE steps should the engineer take?

Accepted Answer

Set up CloudWatch alarms to monitor rotation failures.. Option A is correct because the Lambda rotation function needs permissions to read and update the secret. Option C is correct because using a separate user for rotation allows the old credentials to remain valid during rotation. Option E is correct because CloudWatch alarms can detect rotation failures. Option B is wrong because the rotation function should have network access to the database, but using a VPC endpoint is not required; the function can be in a VPC. Option D is wrong because disabling rotation for old secrets would break the rotation process.

Answer

Disable automatic rotation for the old secret version.

Answer

Configure the Lambda rotation function to use a VPC endpoint for Secrets Manager.

Question 2

A company has an AWS Lambda function that processes sensitive data. The function needs to access an RDS database with credentials stored in Secrets Manager. What is the MOST secure way to grant the Lambda function access to the secret?

Accepted Answer

Attach an IAM role to the Lambda function with permissions to read the secret and retrieve it at runtime.. Option A is correct because using an IAM role with the necessary permissions and retrieving the secret at runtime is standard practice. Option B is wrong because embedding secrets in environment variables is insecure. Option C is wrong because KMS is for encryption, not storing secrets. Option D is wrong because Lambda environment variables can be encrypted but still expose secrets in logs.

Answer

Use AWS KMS to encrypt the credentials and pass them as parameters.

Answer

Store the credentials directly in the Lambda function's environment variables.

Answer

Use Lambda environment variables with encryption enabled.

Question 3

A company uses AWS WAF to protect a web application behind an Application Load Balancer. The security team notices an increase in false positives blocking legitimate traffic. Which action should be taken to reduce false positives while maintaining security?

Accepted Answer

Adjust the rate-based rule threshold to a higher value.. Option B is correct because adjusting the rate-based rule threshold to a higher value will allow more legitimate traffic while still blocking excessive requests. Option A: Removing the rule would weaken security. Option C: Swapping to AWS Shield Advanced does not fine-tune rules. Option D: Count mode logs but does not block; not maintaining security.

Answer

Remove the rate-based rule that is causing false positives.

Answer

Replace AWS WAF with AWS Shield Advanced.

Answer

Change the rule action from 'Block' to 'Count'.

Question 4

A company wants to enforce that S3 buckets are not publicly accessible. Which AWS service can continuously monitor and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config with managed rules can evaluate bucket policies and use automatic remediation via Systems Manager Automation. Option B is correct.

Answer

Amazon Macie

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 5

Refer to the exhibit. A KMS key policy is configured as shown. What does this policy allow?

Accepted Answer

The role to decrypt data encrypted by S3 in us-east-1.. The policy allows the CrossAccountRole to call kms:Decrypt only when the request comes through S3 in us-east-1. Option D is correct.

Answer

The role to decrypt any KMS key.

Answer

The role to decrypt via any AWS service.

Answer

Any IAM role to decrypt using this key.

Question 6

Which TWO actions can be taken to secure an Amazon S3 bucket that contains confidential data? (Choose TWO.)

Accepted Answer

Enable S3 Default Encryption.. Correct options: A and D. Option A: Block public access prevents public exposure. Option D: Enable default encryption ensures data is encrypted at rest. Option B is wrong because versioning helps with recovery, not security. Option C is wrong because cross-region replication is for disaster recovery. Option E is wrong because S3 Transfer Acceleration is for speed, not security.

Answer

Enable S3 Transfer Acceleration.

Answer

Enable S3 Cross-Region Replication.

Answer

Enable S3 Versioning.

Question 7

A company is migrating a legacy application to AWS. The application requires a shared file system accessible from multiple EC2 instances. The compliance team mandates encryption at rest and in transit, with automatic key rotation. Which storage solution meets these requirements?

Accepted Answer

Amazon EFS with encryption at rest and in transit. EFS supports encryption at rest with AWS KMS and encryption in transit via TLS, and can enable automatic key rotation by using a KMS key with automatic rotation. S3 is object storage, not a shared file system. FSx for Windows File Server requires manual key rotation. EBS is block storage, not shared.

Answer

Amazon S3 with server-side encryption

Answer

Amazon EBS with encryption enabled

Answer

Amazon FSx for Windows File Server with encryption

Question 8

A security team wants to enforce that all Amazon S3 buckets in the organization are encrypted at rest. Which actions can achieve this? (Select THREE.)

Accepted Answer

Configure an AWS Config rule to detect unencrypted buckets and trigger remediation. You can create an SCP to deny creation of buckets without encryption, use a Config rule to detect noncompliant buckets, and use a bucket policy to deny PutObject without encryption headers. S3 Block Public Access is for preventing public access, not encryption. Cross-Region Replication does not enforce encryption.

Answer

Enable S3 Block Public Access at the account level

Answer

Set up Cross-Region Replication for all buckets

Question 9

A company uses AWS CodeBuild to build and test code. The security team requires that all build artifacts be encrypted at rest. Which action should the DevOps engineer take to meet this requirement?

Accepted Answer

Enable default encryption on the S3 bucket used for CodeBuild artifacts.. Option A is correct because CodeBuild stores artifacts in an S3 bucket; enabling default encryption on that bucket ensures all objects are encrypted. Option B is wrong because CodeBuild artifacts are stored in S3, not EBS. Option C is wrong because the artifact bucket is managed by the customer. Option D is wrong although it could work, but enabling default encryption on the bucket is simpler and more direct.

Answer

Create a customer-managed KMS key and specify it in the CodeBuild project's artifacts encryption settings.

Answer

Use an S3 bucket policy to deny write operations unless the request includes the x-amz-server-side-encryption header.

Answer

Configure the CodeBuild project to use an encrypted EBS volume for the build environment.

Question 10

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be automatically rotated every year. Which KMS key type should the company use to meet this requirement without manual intervention?

Accepted Answer

Customer managed key. AWS managed keys (AWS managed key) are automatically rotated every three years, not every year. Customer managed keys (Customer managed key) can be configured for automatic annual rotation. Imported key material cannot be automatically rotated. A Custom key store does not support automatic rotation.

Answer

Imported key material

Answer

Custom key store (CloudHSM)

Answer

AWS managed key

Question 11

Which TWO AWS services can be used to monitor for unauthorized API calls in an AWS account? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls and can be used to monitor for unauthorized activity. AWS Config evaluates resource configurations against rules. GuardDuty provides intelligent threat detection using CloudTrail logs, VPC Flow Logs, and DNS logs. CloudWatch Logs can store logs but does not directly monitor for unauthorized calls. S3 is for storage.

Answer

AWS Config

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Question 12

A DevOps engineer must ensure that all API calls in an AWS account are logged for compliance. The logs should be stored in an S3 bucket with server-side encryption enabled. Which two services should be used together to meet these requirements?

Accepted Answer

AWS CloudTrail and Amazon S3. Option C is correct because AWS CloudTrail logs API calls and can deliver logs to an S3 bucket. S3 server-side encryption can be enabled on the bucket. Option A: Config records resource changes, not API calls. Option B: CloudWatch Logs can store logs but not automatically encrypt; also not the primary service for API logging. Option D: VPC Flow Logs capture network traffic, not API calls.

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Answer

Amazon VPC Flow Logs and Amazon S3

Answer

AWS Config and AWS CloudTrail

Question 13

A company wants to audit all changes to IAM policies in their AWS account. Which THREE services can be used to capture and alert on IAM policy changes? (Choose THREE.)

Accepted Answer

AWS Config. Options A, B, and D are correct. AWS CloudTrail logs all IAM API calls. AWS Config can track resource changes and trigger rules. Amazon EventBridge can create rules to detect specific CloudTrail events and trigger notifications. Option C: AWS Trusted Advisor provides best practice checks, not change auditing. Option E: Amazon Inspector is for security vulnerabilities.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 14

Which TWO actions should a DevOps engineer take to secure an AWS account root user? (Choose 2.)

Accepted Answer

Delete or disable the root user access keys.. Enabling MFA and not creating access keys for the root user are best practices. Options B and D are correct.

Answer

Share the root user password with the team.

Answer

Create an IAM role for the root user.

Answer

Use the root user for daily administrative tasks.

Question 15

A company has an S3 bucket containing sensitive data. They need to ensure that all access to the bucket is logged and that any unauthorized access attempts are immediately notified. Which combination of services should be used?

Accepted Answer

Amazon S3 server access logs and Amazon Macie. Option B is correct because S3 server access logs provide logging, and Amazon Macie can alert on sensitive data exposure. Option A is wrong because CloudTrail logs API calls but not data-level access to S3. Option C is wrong because VPC Flow Logs are for network traffic, not S3 access. Option D is wrong because CloudWatch Logs alone does not provide notifications.

Answer

Amazon CloudWatch Logs and Amazon SNS

Answer

VPC Flow Logs and Amazon GuardDuty

Answer

AWS CloudTrail and Amazon CloudWatch Alarms

Question 16

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all new S3 buckets created in any account within the organization are configured with block public access enabled. Which approach is the most scalable and least operationally burdensome?

Accepted Answer

Attach an SCP to the organization root that denies s3:CreateBucket unless the request includes 's3:PutBucketPublicAccessBlock'.. Option C is correct because a service control policy (SCP) can deny the creation of S3 buckets without the 'BlockPublicAccess' settings. This applies to all accounts in the organization. Option A is wrong because AWS Config is reactive, not preventive. Option B is wrong because it requires configuring each account individually. Option D is wrong because CloudTrail is for auditing, not prevention.

Answer

Use an AWS Config managed rule to detect non-compliant buckets and trigger a remediation Lambda function.

Answer

Enable AWS CloudTrail and create a metric filter to alert on bucket creation, then manually review.

Answer

Apply an S3 bucket policy in each account that denies s3:PutBucketPublicAccessBlock with a condition.

Question 17

A company is designing a secure CI/CD pipeline using AWS CodePipeline. The pipeline must comply with the principle of least privilege for IAM permissions. Which TWO actions should the DevOps engineer take? (Choose TWO.)

Accepted Answer

Scope IAM policies to specific resources, such as specific S3 buckets and CodeBuild projects.. Option A is correct because using separate roles for each action limits permissions. Option D is correct because scoping permissions to specific resources follows least privilege. Option B is wrong because a single role with all permissions is not least privilege. Option C is wrong because using the same role is not secure. Option E is wrong because SCPs are for organization-level, not pipeline.

Answer

Use the same IAM role for all pipeline stages to simplify management.

Answer

Use an SCP to deny all pipeline actions except those explicitly allowed.

Answer

Attach an IAM policy to the pipeline itself that grants full access to all services.

Question 18

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to download an object from 'example-bucket' from an IP address 10.0.0.5. However, the request is denied. What is the most likely reason?

Accepted Answer

The policy does not grant s3:ListBucket permission, which is required to access objects.. Option B is correct because the policy uses a condition key 'aws:SourceIp' which is not evaluated correctly for S3; S3 uses 'aws:SourceIp' only when the request is authenticated via IAM, but for anonymous requests it doesn't apply. However, the more common issue is that the policy does not allow the s3:ListBucket action, which is required to list objects. Option A is wrong because the IP is within range. Option C is wrong because the bucket exists. Option D is wrong because the policy allows GetObject.

Answer

The bucket 'example-bucket' does not exist in the account.

Answer

The policy uses 'aws:SourceIp' which is not supported for S3.

Answer

The IP address 10.0.0.5 is not in the allowed range.

Question 19

An application running on EC2 needs to access an S3 bucket. To follow the principle of least privilege, what is the recommended approach?

Accepted Answer

Create an IAM role with a policy allowing only necessary S3 actions and attach it to the EC2 instance. The best practice is to create an IAM role with a policy that grants only the required S3 actions and attach the role to the EC2 instance. This avoids using long-term credentials. Access keys are long-term and insecure. Bucket policy can be used but is not the most secure for instance access. Security group is for network access, not API access.

Answer

Store AWS access keys in the application configuration

Answer

Use an S3 bucket policy to allow access from the EC2 instance's public IP

Answer

Configure the EC2 security group to allow outbound access to S3

Question 20

A company uses AWS CodePipeline to deploy a web application. The deployment includes an EC2 instance running behind an Application Load Balancer. The security team requires that all data in transit to the application be encrypted. Which configuration best meets this requirement without breaking the deployment?

Accepted Answer

Create an HTTPS listener on the ALB with a certificate from AWS Certificate Manager and redirect HTTP to HTTPS.. Option C is correct because the Application Load Balancer supports SSL/TLS termination using certificates from AWS Certificate Manager, enabling HTTPS encryption. Option A is wrong because CodePipeline does not encrypt traffic at the ALB level. Option B is wrong because AWS WAF is a web application firewall, not for encryption. Option D is wrong because CloudFront can handle HTTPS, but adding it changes the architecture unnecessarily and may break the pipeline if not properly configured.

Answer

Configure CodePipeline to use an encrypted artifact bucket.

Answer

Enable AWS WAF on the ALB to enforce HTTPS.

Answer

Place a CloudFront distribution in front of the ALB and configure it to require HTTPS.