DOP-C02 Mock Exam 76 — 25 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail logs. What is the most effective way to enforce this control?

Accepted Answer

Apply a Service Control Policy that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging.. Option D is correct because a Service Control Policy (SCP) can deny actions like cloudtrail:DeleteTrail and cloudtrail:StopLogging across all accounts in the organization. Option A is wrong because CloudTrail is a regional service, and disabling in one region would still affect logs. Option B is wrong because IAM policies are per-account and can be overridden by account admins. Option C is wrong because limiting to one trail is not a control; accounts could still modify that trail.

Answer

Require all accounts to use the same CloudTrail trail.

Answer

Create an IAM policy in each account that denies cloudtrail:DeleteTrail.

Answer

Configure CloudTrail to log to an S3 bucket in a centralized logging account and deny access to the bucket from member accounts.

Question 2

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with AWS Key Management Service (SSE-KMS) and enforce that all new objects are encrypted. Which bucket policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}. Option A is correct because it denies s3:PutObject if the encryption key is not the specified KMS key. Option B is wrong because it denies PutObject if encryption is not AES256, which enforces SSE-S3, not SSE-KMS. Option C is wrong because the condition key s3:x-amz-server-side-encryption-aws-kms-key-id is not valid. Option D is wrong because the condition key s3:ServerSideEncryption is not a valid condition key.

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:ServerSideEncryption":"awskms"}}}

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}

Question 3

Which THREE components are necessary to implement a secure VPC with a public subnet and a private subnet that hosts a database? (Choose THREE.)

Accepted Answer

Internet Gateway attached to the VPC.. Correct options: A, B, and D. Option A: NAT Gateway allows private subnet instances to access the internet. Option B: Internet Gateway allows public subnet instances to access the internet. Option D: Security groups act as firewalls for the database. Option C is wrong because VPN is not necessary. Option E is wrong because VPC Peering is for connecting VPCs.

Answer

AWS Site-to-Site VPN connection.

Answer

VPC Peering connection to a central VPC.

Question 4

A DevOps engineer needs to ensure that all API calls made to AWS services are logged for auditing purposes. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail records API calls for auditing. Option A is wrong because CloudWatch Logs is for log storage, not recording API calls. Option B is wrong because AWS Config records resource configuration changes. Option D is wrong because VPC Flow Logs capture network traffic.

Answer

AWS Config

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Question 5

A DevOps engineer needs to ensure that an S3 bucket policy enforces encryption in transit for all access. Which policy statement should be added?

Accepted Answer

{"Effect":"Deny","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. To enforce encryption in transit, use a condition that denies access unless the request uses 'aws:SecureTransport' set to 'true'. This requires a Deny effect with the condition.

Answer

{"Effect":"Deny","Condition":{"StringEquals":{"aws:SecureTransport":"true"}}}

Answer

{"Effect":"Allow","Condition":{"Bool":{"aws:SecureTransport":"false"}}}

Answer

{"Effect":"Allow","Condition":{"Bool":{"aws:SecureTransport":"true"}}}

Question 6

Which AWS services can be used to protect a web application from common web exploits like SQL injection and cross-site scripting? (Select TWO.)

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that filters malicious requests. CloudFront can be integrated with WAF to provide protection at the edge. Shield Advanced provides DDoS protection, not application-layer exploits. Cognito is for authentication. Inspector is for vulnerability scanning.

Answer

AWS Shield Advanced

Answer

Amazon Inspector

Answer

Amazon Cognito

Question 7

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that any changes to IAM roles must be reviewed and approved by a security engineer before deployment. The DevOps engineer needs to implement a gating mechanism. Which approach should the engineer use?

Accepted Answer

Create a CodePipeline that deploys CloudFormation stacks and include a manual approval step for changes that modify IAM resources.. Option B is correct because CloudFormation StackSets with approval gates in CodePipeline allow manual approval steps before applying updates. Option A is wrong because AWS Config detects changes but does not prevent them. Option C is wrong because IAM policy conditions cannot prevent CloudFormation from creating roles. Option D is wrong because service control policies affect all actions, not just IAM changes, and are too broad.

Answer

Use AWS Config to detect changes to IAM roles and trigger a Lambda function that reverts the change.

Answer

Apply a service control policy that denies iam:CreateRole and iam:UpdateAssumeRolePolicy across the organization.

Answer

Add a condition to the IAM policy that requires MFA for any CloudFormation action.

Question 8

A DevOps engineer needs to grant an IAM user temporary access to an S3 bucket for exactly one hour. Which AWS service should be used to generate temporary credentials?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is used to generate temporary, limited-privilege credentials for IAM users or federated users. IAM roles provide temporary credentials but are assumed, not generated for a specific user. Cognito is for identity federation with mobile/web apps. SSO provides single sign-on access.

Answer

Amazon Cognito

Answer

AWS SSO

Answer

AWS IAM

Question 9

Which THREE of the following are valid methods to enforce encryption at rest for Amazon EBS volumes? (Choose three.)

Accepted Answer

Enable EBS encryption by default in the account.. Enabling EBS encryption by default at the account level ensures all new volumes are encrypted. You can also encrypt volumes when creating them via the console or CLI. You cannot encrypt an existing volume directly; you must create a snapshot, copy it with encryption, and create a new volume. Attaching a volume does not encrypt it.

Answer

Use the AWS CLI to encrypt an existing volume in place.

Answer

Attach the volume to an EC2 instance and use OS-level encryption.

Question 10

A company is migrating a legacy application to AWS. The application requires cross-account access to an S3 bucket in a different AWS account. The security team wants to follow the principle of least privilege. How should the DevOps engineer configure the access?

Accepted Answer

Create an IAM role in the source account with necessary permissions and attach a bucket policy in the target account granting access to that role.. Option D is correct because using an IAM role in the source account with a bucket policy in the target account that allows the role is the recommended cross-account access pattern. Option A is wrong because using root user credentials is insecure. Option B is wrong because access keys should not be hardcoded. Option C is wrong because IAM users in the source account should not be used directly; a role is preferred.

Answer

Generate an access key for the root user of the source account and use it in the application.

Answer

Create an IAM user in the target account with access keys and store them in AWS Secrets Manager.

Answer

Create an IAM user in the source account with programmatic access and a bucket policy allowing that user.

Question 11

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are tamper-proof and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses SHA-256 hashing and digital signing to ensure logs have not been tampered with. S3 object lock prevents deletion but not modification. MFA delete protects deletion but not modification. SSE encrypts data at rest but does not protect integrity.

Answer

Server-side encryption (SSE-S3)

Answer

S3 Object Lock

Answer

MFA delete on the S3 bucket

Question 12

A DevOps engineer is configuring AWS Config to detect changes to security group rules. The engineer wants to receive near-real-time notifications when a security group rule that allows inbound SSH traffic is created. Which combination of services and configurations should the engineer use? (Choose the best answer.)

Accepted Answer

Create an AWS Config rule to evaluate security groups, and configure an Amazon EventBridge rule to match 'Config Rules Compliance Change' events and trigger an SNS topic.. Option B is correct because AWS Config uses managed rules (like restricted-ssh) and can stream configuration changes to CloudWatch Events (now Amazon EventBridge), which triggers a Lambda function to send SNS notifications. Option A is wrong because AWS Config does not directly send to SNS without an intermediary. Option C is wrong because GuardDuty focuses on threats, not configuration changes. Option D is wrong because CloudTrail logs API calls but not configuration state changes directly; using Config is more appropriate.

Answer

Enable Amazon GuardDuty and create a custom threat list for SSH access.

Answer

Use AWS CloudTrail to monitor CreateSecurityGroup API calls and send events to CloudWatch Logs.

Answer

Set up AWS Config to send configuration change notifications directly to an SNS topic.

Question 13

A DevOps engineer is tasked with auditing all AWS API calls made in the account for compliance purposes. The engineer needs to ensure that the audit logs are tamper-proof and stored cost-effectively. Which TWO services should the engineer use?

Accepted Answer

AWS CloudTrail. Option B is correct because CloudTrail logs API calls and can be configured to deliver to S3. Option D is correct because S3 with object lock prevents log tampering. Option A is wrong because CloudWatch Logs is for application logs, not API calls. Option C is wrong because Config records resource changes, not API calls. Option E is wrong because KMS encrypts but does not provide tamper-proof storage; object lock does.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS KMS

Question 14

A company wants to ensure that all S3 buckets are encrypted at rest by default. Which S3 feature should be enabled at the bucket level to automatically encrypt new objects?

Accepted Answer

Default encryption. S3 default encryption allows you to set a default encryption behavior for a bucket, so that all new objects are encrypted at rest automatically. Bucket policies can enforce encryption but do not automatically encrypt. Object lock is for retention. Versioning is for object versions.

Answer

S3 Object Lock

Answer

Bucket policy with a Deny for unencrypted uploads

Answer

S3 Versioning

Question 15

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). The application uses HTTPS. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. The instances currently use a self-signed certificate for the backend HTTPS listener. The engineer notices that the ALB health checks are failing, and the error message indicates 'TLS handshake failed'. The health check is configured as HTTPS. What should the engineer do to resolve the health check failure while maintaining encryption?

Accepted Answer

Install a valid certificate from AWS Certificate Manager (ACM) on each EC2 instance and configure the ALB target group to use HTTPS with that certificate.. The ALB health check expects a valid certificate from the target. Self-signed certificates cause health checks to fail unless the ALB is configured to ignore certificate verification. The ALB can be configured to verify or skip verification. To fix, the engineer should either configure the target group to use HTTP for health checks (while using HTTPS for data traffic) or configure the target group to use HTTPS with a certificate that the ALB trusts (e.g., from ACM). The simplest is to use HTTP health checks, but the requirement is to maintain encryption. However, health checks can be over HTTP if the data traffic uses HTTPS. Alternatively, the engineer can install a certificate from ACM on the instances, but that is more complex. The most practical solution is to use HTTP for health checks (which is not encrypted) but the question says maintain encryption. The best answer is to install a trusted certificate (e.g., from ACM) on the instances.

Answer

Change the health check to use HTTP on port 80 and allow HTTP traffic from the ALB to the instances.

Answer

Configure the ALB to ignore certificate verification for health checks by setting the health check protocol to HTTPS and enabling 'ignore certificate' option.

Answer

Disable health checks on the ALB and rely on CloudWatch alarms to detect instance failures.

Question 16

A company is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The security team requires that all artifacts be encrypted at rest and in transit. Which configuration ensures encryption for all stages?

Accepted Answer

Enable default encryption on the S3 artifact bucket and ensure all connections use HTTPS.. Option B is correct because enabling default encryption on the S3 artifact bucket ensures encryption at rest, and using HTTPS for all endpoints ensures encryption in transit. Option A is wrong because KMS encryption for CodePipeline is not automatic. Option C is wrong because CodeCommit already uses HTTPS; additional steps not needed. Option D is wrong because encryption at rest is not automatically enabled.

Answer

Enable AWS KMS encryption on the CodePipeline artifact bucket and use SSH for CodeCommit.

Answer

Use an AWS Certificate Manager (ACM) certificate for CodeBuild and CodeDeploy endpoints.

Answer

Encrypt the CodePipeline artifact using the pipeline's built-in encryption feature.

Question 17

A company wants to protect its AWS account credentials. Which TWO practices are recommended by AWS? (Choose TWO.)

Accepted Answer

Enable multi-factor authentication (MFA) for privileged users.. Option B is correct because MFA adds an extra layer of security. Option D is correct because IAM roles are preferred for applications. Option A is wrong because root user should not be used daily. Option C is wrong because access keys should be rotated regularly. Option E is wrong because sharing passwords is insecure.

Answer

Generate and share access keys for all users.

Answer

Store IAM user passwords in a shared document.

Answer

Use the root user for daily administrative tasks.

Question 18

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance with the tag 'Environment=production' in us-east-1. What will happen?

Accepted Answer

The action is denied because the Deny statement explicitly denies the action for production instances.. Option C is correct because the Deny statement explicitly denies TerminateInstances for instances with tag Environment=production, regardless of any Allow. Option A is wrong because Deny overrides Allow. Option B is wrong because the Deny applies to all instances with that tag. Option D is wrong because the Deny is explicit.

Answer

The action is allowed because there is no explicit Deny for the user.

Answer

The action is denied only if the instance is in the us-east-1 region.

Answer

The action is allowed because the Allow statement grants ec2:TerminateInstances.

Question 19

A company needs to audit all changes to IAM policies in their AWS account. Which services can be used to track and log these changes? (Select TWO.)

Accepted Answer

AWS Config. AWS CloudTrail logs API calls, including IAM policy changes. AWS Config can track configuration changes to IAM resources. CloudWatch Logs stores logs but does not track changes itself. GuardDuty is for threat detection. S3 is storage.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 20

A DevOps engineer is designing an AWS Lambda function that needs to read secrets from AWS Secrets Manager. What is the most secure way to provide the Lambda function access to the secret?

Accepted Answer

Assign an IAM execution role to the Lambda function with a policy that allows secretsmanager:GetSecretValue on the specific secret.. Option B is correct because the Lambda execution role should have an IAM policy with permissions to access the specific secret. Option A is wrong because hardcoding secrets is insecure. Option C is wrong because SSM Parameter Store is separate; if using Secrets Manager, permissions should be on that service. Option D is wrong because environment variables are not encrypted by default and are visible in the console.

Answer

Store the secret in AWS Systems Manager Parameter Store and grant the Lambda function access to the parameter.

Answer

Encrypt the secret using AWS KMS and pass the encrypted value as an environment variable.

Answer

Store the secret in an environment variable in the Lambda function.