DOP-C02 Mock Exam 77 — 25 Questions

Question 1

A company has a security policy requiring that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. The DevOps engineer needs to enforce this policy. What is the simplest way to achieve this?

Accepted Answer

Create an IAM policy that denies all actions unless MFA is present, and attach it to all IAM users or groups.. Option A is correct because an IAM policy with a condition for aws:MultiFactorAuthPresent: true can be attached to a group or user to deny access if MFA is not used. Option B is wrong because MFA cannot be enforced at the resource level for S3. Option C is wrong because it only applies to root user, not IAM users. Option D is wrong because Cognito is for application users, not AWS console access.

Answer

Use Amazon Cognito to require MFA for console access.

Answer

Enable MFA delete on the root account.

Answer

Enable MFA on the S3 bucket policy.

Question 2

A company is using AWS Lambda to process sensitive data. The security team requires that the Lambda function only be invoked from within a specific VPC and that the function's environment variables be encrypted at rest. Which TWO actions should the DevOps engineer take to meet these requirements?

Accepted Answer

Enable AWS KMS encryption for the Lambda function's environment variables using a customer-managed key.. Option A is correct because configuring the Lambda function to access a VPC and using a VPC endpoint for Lambda ensures invocation only from within the VPC. Option D is correct because using AWS KMS to encrypt environment variables meets the encryption requirement. Option B is wrong because resource-based policies control which principals can invoke, but cannot restrict to VPC origin alone. Option C is wrong because CloudWatch Logs encryption is separate from environment variables. Option E is wrong because execution role permissions do not encrypt environment variables.

Answer

Enable encryption for CloudWatch Logs using a KMS key.

Answer

Assign an IAM execution role with permissions to access a KMS key.

Answer

Attach a resource-based policy to the Lambda function that denies invoke unless the request comes from the VPC.

Question 3

Refer to the exhibit. An IAM policy is attached to an IAM user. Which of the following actions will be allowed by this policy?

Accepted Answer

DescribeInstances on an instance in us-east-1. Option B is correct because the Deny statement only denies ec2 actions on instances when the requested region is NOT us-east-1. Since DescribeInstances is allowed by the first statement and the Deny does not apply to DescribeInstances (action is ec2:*, but the condition only denies if region is not us-east-1, and if the request is for us-east-1, the condition is false, so the Deny does not apply. However, note that the Deny statement denies all ec2 actions (including DescribeInstances) on instances when the condition is met. But if the request is for us-east-1, the condition is false, so no Deny, so DescribeInstances in us-east-1 is allowed. Option A is wrong because StopInstances is an ec2 action on an instance, and if the region is us-east-1, the condition is false, so the Deny does not apply, but the Allow statement only allows DescribeInstances, not StopInstances. Since there is no explicit Allow for StopInstances, it is implicitly denied. Option C is wrong because if the region is us-west-2, the condition is true, so the Deny applies to all ec2 actions on instances, including DescribeInstances, so it is denied. Option D is wrong because although the Deny would apply to StartInstances if region is not us-east-1, but if region is us-east-1, the Deny does not apply, but there is no Allow for StartInstances, so it is implicitly denied.

Answer

StartInstances on an instance in us-east-1

Answer

DescribeInstances on an instance in us-west-2

Answer

StopInstances on an instance in us-east-1

Question 4

A DevOps engineer created the IAM policy shown in the exhibit and attached it to a user. The user tries to upload an object to my-bucket without specifying the ACL. Why does the upload fail?

Accepted Answer

The policy condition requires the ACL to be bucket-owner-full-control, but the user did not specify it. The policy condition requires the ACL to be 'bucket-owner-full-control'. If the user does not specify an ACL, the default is usually 'private', which does not satisfy the condition. Therefore the action is denied. The resource ARN is correct. The action is allowed. The condition specifies StringEquals, which is correct for comparison.

Answer

The Effect should be Deny for this policy to work

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket

Answer

The user does not have permission to list the bucket

Question 5

A company is using Amazon S3 to store sensitive data. The security team mandates that all data must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS). The DevOps engineer must ensure that any new objects uploaded to the bucket are automatically encrypted. What should the engineer do?

Accepted Answer

Enable default encryption on the S3 bucket and select AWS-KMS as the encryption method.. Option A is correct because enabling default encryption on the S3 bucket with SSE-KMS ensures all objects are encrypted with KMS. Option B is wrong because bucket policies only enforce encryption headers, not default encryption, and can be bypassed. Option C is wrong because CORS is for cross-origin requests. Option D is wrong because versioning does not encrypt data.

Answer

Enable CORS on the bucket to allow encrypted uploads.

Answer

Apply a bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header with aws:kms.

Answer

Enable S3 Versioning to protect encrypted objects.

Question 6

Refer to the exhibit. An IAM policy is attached to a user. The user requests an object from the 'example-bucket' bucket, specifically from the 'confidential' folder, over HTTP (not HTTPS). The source IP is within the 10.0.0.0/24 range. What will be the result of this request?

Accepted Answer

Denied, because the request uses HTTP and the Deny statement blocks it.. The Deny statement with SecureTransport false applies to all s3 actions on the confidential folder. Even though the source IP is allowed, the Deny for HTTP access will override the Allow. The request will be denied.

Answer

Denied, because the user does not have s3:GetObject permission on the confidential folder.

Answer

Allowed, because the Deny statement only applies to HTTPS.

Answer

Allowed, because the source IP is within the allowed range.

Question 7

Which TWO of the following are benefits of using AWS Certificate Manager (ACM) to manage SSL/TLS certificates? (Choose two.)

Accepted Answer

Automatic renewal of certificates.. ACM automatically renews certificates before expiry, reducing manual overhead. It integrates with AWS services like ALB and CloudFront for easy deployment. ACM can export certificates for use on EC2 instances, but that is not a primary benefit; the main benefits are automatic renewal and integration.

Answer

Ability to use the same certificate on multiple EC2 instances.

Answer

Support for wildcard certificates only.

Answer

Free certificates for use on any AWS service.

Question 8

A DevOps engineer executed the CLI command shown in the exhibit. After creation, the security team requires that the log files be encrypted with a KMS key that is rotated every 90 days. The current key is a customer managed key with automatic rotation enabled set to 365 days. What should the engineer do to meet the requirement?

Accepted Answer

Create a new KMS key with automatic rotation set to 90 days and update the trail with the new key. To change the KMS key or its rotation period, you must update the trail. You can specify a new key with the --kms-key-id parameter when updating the trail. Changing the key rotation period is done through KMS, not CloudTrail. But the question is about meeting the 90-day rotation. The engineer should update the trail to use a different KMS key that has a rotation period of 90 days. Note: You cannot change the rotation period of an existing KMS key; you must create a new one. However, the options: B is correct because you can update the trail to use a new key with the desired rotation. A is wrong because you cannot change rotation period of existing key; you create a new key. C is wrong because the key is already used; you can't modify its rotation period. D is wrong because disabling rotation is opposite.

Answer

Use the existing key and change the rotation period in KMS

Answer

Disable automatic rotation and manually rotate the key every 90 days

Answer

Modify the KMS key to set the rotation period to 90 days

Question 9

A DevOps engineer needs to grant cross-account access to an S3 bucket in Account A for users in Account B. The users in Account B must be able to list objects and read them. What is the most secure way to configure this access?

Accepted Answer

Create a bucket policy in Account A granting access to the root user of Account B, and create an IAM policy in Account B allowing the users to access the bucket.. Option C is correct because it combines a bucket policy in Account A granting access to Account B's root or specific ARN, and an IAM policy in Account B allowing users to access that bucket. Option A is wrong because a bucket policy alone is insufficient; Account B users also need IAM permissions. Option B is wrong because an IAM role in Account A with a trust policy from Account B is a common pattern, but the question specifies users in Account B, so the role approach works but requires users to assume the role; option C is more direct for S3 access. Option D is wrong because KMS is for encryption, not access control.

Answer

Create a bucket policy in Account A that grants access to the IAM user ARNs from Account B.

Answer

Create a KMS key in Account A and share it with Account B to decrypt objects.

Answer

Create an IAM role in Account A with trust policy allowing Account B to assume it, and attach a policy granting S3 access.

Question 10

A company uses AWS Secrets Manager to store database credentials. The security team requires that secrets be automatically rotated every 30 days. Which rotation strategy should the engineer configure to meet this requirement with minimal operational overhead?

Accepted Answer

Enable automatic rotation using the pre-built Lambda rotation function for the database type.. Secrets Manager can automatically rotate secrets using a Lambda function. The easiest way is to use the pre-built Lambda rotation function for the specific database type (e.g., Amazon RDS). Creating a custom Lambda function is more overhead. Manually rotating via CLI defeats automation. Using Systems Manager Parameter Store with SecureString does not provide built-in rotation.

Answer

Manually rotate the secret every 30 days using the AWS CLI.

Answer

Store the secret in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Enable automatic rotation with a custom Lambda function.

Question 11

A company uses AWS Secrets Manager to store database credentials. The security team wants to automatically rotate secrets every 30 days. The database is an Amazon RDS for PostgreSQL instance. The team has configured automatic rotation with a Lambda function that updates the password in RDS and Secrets Manager. However, after the first rotation, the application starts getting database connection errors. The application uses a connection string with the secret ARN and retrieves the secret from Secrets Manager at startup using the AWS SDK. Which of the following is the most likely cause of the connection errors?

Accepted Answer

The application caches the secret at startup and does not refresh it after rotation.. Option B is correct because if the application caches the secret, it will not pick up the new password after rotation, leading to connection errors. Option A is incorrect because RDS automatic password rotation is not a feature; Secrets Manager handles rotation. Option C is incorrect because KMS permissions are needed to decrypt the secret, but if the application could access the secret initially, it likely has permissions. Option D is incorrect because Lambda function concurrency is unlikely to cause connection errors; it would affect the rotation process itself.

Answer

The Lambda function is not configured with a sufficient timeout and is being throttled.

Answer

The Lambda function does not have permission to update the secret in Secrets Manager.

Answer

The RDS instance has automatic password rotation enabled, which conflicts with Secrets Manager rotation.

Question 12

A company is deploying a multi-tier application on AWS. The web tier must be publicly accessible, but the application tier must only be accessible from the web tier. The database tier should not be accessible from the internet at all. Which combination of security groups and network ACLs should be used?

Accepted Answer

Use security groups: allow 0.0.0.0/0 on port 80/443 to web tier, allow web tier security group to app tier, allow app tier security group to database tier.. Security groups are stateful and default to deny all inbound. By allowing inbound on port 80/443 from 0.0.0.0/0 to the web tier, and allowing inbound from the web tier's security group to the app tier, and only allowing inbound from the app tier to the database tier, you achieve the required isolation. Network ACLs are stateless and not needed if security groups are properly configured.

Answer

Use security groups: allow 0.0.0.0/0 on all ports to web tier, allow all traffic between all instances.

Answer

Place all instances in the same security group with inbound rules allowing only ports 80/443 from 0.0.0.0/0.

Answer

Use network ACLs: allow 0.0.0.0/0 on port 80/443 to web subnet, allow web subnet to app subnet, allow app subnet to database subnet.

Question 13

A company uses AWS Lambda functions to process sensitive data from an SQS queue. The Lambda function writes results to an S3 bucket. The security team requires that all data at rest in S3 be encrypted with a customer managed KMS key, and that the Lambda function only have access to decrypt the queue messages and encrypt the S3 objects. An IAM role is attached to the Lambda function. The engineer has configured the KMS key policy to allow the Lambda role to use the key. However, the Lambda function fails to write to S3 with a 'KMS access denied' error. The engineer verified that the S3 bucket has default encryption enabled with the same KMS key. Which additional step is most likely required?

Accepted Answer

Add an inline policy to the Lambda role that allows kms:GenerateDataKey and kms:Encrypt actions for the KMS key.. Even if the S3 bucket has default encryption, the Lambda function needs kms:GenerateDataKey permission (or kms:Encrypt) in its IAM role to encrypt objects when writing. The key policy allows the role, but the role's permissions policy must also include the necessary KMS actions. The error indicates that the role lacks the appropriate KMS action.

Answer

Disable default encryption on the S3 bucket and configure the Lambda to use SSE-S3.

Answer

Grant the Lambda role s3:PutObject permission on the bucket.

Answer

Modify the KMS key policy to allow the Lambda role to use the key without any conditions.

Question 14

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts are encrypted with AES-256 (SSE-S3) and that public access is blocked. The team wants to use a preventive control that automatically remediates non-compliant buckets. Which solution should the security team implement?

Accepted Answer

Create a Service Control Policy (SCP) that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the bucket is not configured correctly.. Option C is correct because an SCP can deny actions that create or modify buckets without encryption or with public access enabled. This is a preventive control that applies to all accounts in the organization. Option A is incorrect because AWS Config rules are detective, not preventive; they can trigger auto-remediation but after the fact. Option B is incorrect because CloudTrail is for logging, not enforcement. Option D is incorrect because Service Control Policies can only be applied to accounts or OUs, not to resources directly; but they can deny the bucket creation/modification actions.

Answer

Enable CloudTrail to log all S3 API calls and set up a CloudWatch Events rule to notify the security team.

Answer

Use AWS Identity and Access Management (IAM) policies to deny access to S3 buckets that do not have encryption enabled.

Answer

Use AWS Config rules to detect non-compliant buckets and trigger a Lambda function to remediate.

Question 15

A DevOps engineer needs to encrypt data in transit between an Application Load Balancer (ALB) and backend EC2 instances. The application uses HTTPS. What is the simplest way to achieve this encryption?

Accepted Answer

Configure the ALB listener to use HTTPS, and configure the target group to use HTTPS with a self-signed certificate on the instances.. An ALB can terminate HTTPS at the listener and then communicate with backend instances using HTTP if desired. However, to encrypt in transit, you can use HTTPS between ALB and instances as well. The simplest way is to install the same certificate on both ALB and instances, but ALB can use a self-signed certificate. Using an internal CA or ACM Private CA is more complex. Using a TCP listener does not provide encryption.

Answer

Use an AWS Private Certificate Authority to issue certificates for the instances.

Answer

Use a Network Load Balancer instead with TLS listeners.

Answer

Place both ALB and instances in a VPC with default security groups.

Question 16

A startup wants to provide temporary, limited-privilege AWS access to external contractors who will assist with a project. The contractors do not have AWS accounts. The company wants to avoid creating IAM users for each contractor. They need a solution that allows contractors to log in to the AWS Management Console for a limited time. Which AWS service should the engineer use?

Accepted Answer

Use AWS SSO with an external identity provider, and grant access to an AWS account with a permission set.. AWS SSO can be used to grant external users access to AWS accounts via a portal, with temporary credentials. You can invite users as external members in AWS SSO, and they can log in with their own email and receive temporary credentials. IAM roles cannot be directly assumed without AWS credentials. Cognito is for app users. IAM users would require creating permanent users.

Answer

Create IAM users for each contractor and attach a policy with a condition to expire access after the project.

Answer

Use Amazon Cognito user pools to create temporary user accounts.

Answer

Provide the contractors with the root user credentials of a separate AWS account.

Question 17

A company uses Amazon Inspector to scan EC2 instances for vulnerabilities. The security team discovers that a critical vulnerability is present on an instance, but the instance is part of an Auto Scaling group. What is the MOST efficient way to remediate this vulnerability while ensuring the Auto Scaling group remains operational?

Accepted Answer

Create a new AMI with the patch, update the Auto Scaling group's launch template, and terminate instances one by one to trigger replacement.. The most efficient way is to create a new Amazon Machine Image (AMI) with the vulnerability patched, update the Auto Scaling group's launch configuration/template to use the new AMI, and then perform a rolling update (e.g., by terminating instances one by one). Manually patching each instance is inefficient because Auto Scaling will launch new instances from the old AMI. Using AWS Systems Manager Patch Manager can patch on the fly but does not update the launch template for future instances. Isolating the instance does not fix the root cause.

Answer

Patch the instance manually via SSH, then create a new AMI from it and update the launch configuration.

Answer

Detach the instance from the Auto Scaling group, patch it, and reattach it.

Answer

Use AWS Systems Manager Patch Manager to patch the instance and then set the instance to not receive future updates.

Question 18

A company wants to enable AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team requires that logs be encrypted at rest and that any unauthorized deletion of log files be prevented. Which TWO actions should the security team take? (Choose TWO.)

Accepted Answer

Create a trail in the management account that applies to all accounts in the organization.. Option A is correct because enabling CloudTrail for all accounts in the organization ensures centralized logging. Option D is correct because S3 Object Lock prevents deletion of log files. Option B is incorrect because KMS with a customer managed key provides encryption, but the key must be created beforehand, not just enabled. Option C is incorrect because CloudWatch Logs encryption uses KMS, not S3 SSE. Option E is incorrect because CloudTrail can be configured to log management events by default, and this is not about data events.

Answer

Enable default encryption with SSE-S3 on the S3 bucket where CloudTrail delivers logs.

Answer

Configure CloudTrail to send logs to Amazon CloudWatch Logs and enable encryption using an AWS KMS key.

Answer

Enable CloudTrail Insights to detect unusual API activity.

Question 19

A company uses AWS CodePipeline for CI/CD. The security team requires that all code changes be scanned for secrets before deployment. The pipeline consists of a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The security team wants to automatically scan for secrets and block the pipeline if any secrets are found. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Configure the build project to fail the build if the scanning tool returns a non-zero exit code.. Option A is correct because using a scanning action in the build stage can catch secrets. Option C is correct because CodeBuild can fail the build if secrets are found, preventing deployment. Option E is correct because IAM permissions are needed for CodeBuild to access the scanning tool. Option B is incorrect because S3 bucket policies are not relevant. Option D is incorrect because post-deployment scanning would not block the pipeline before deployment.

Answer

Add a scanning action in the deploy stage to scan after deployment.

Answer

Configure an S3 bucket policy to deny access if secrets are detected.

Question 20

A security engineer needs to audit who accessed a specific S3 object and from which IP address over the past 30 days. Which AWS service should be used?

Accepted Answer

Amazon S3 server access logs. Option D is correct because S3 server access logs provide detailed records of requests, including requester identity and IP address. Option A is wrong because CloudTrail records management events but not data events by default. Option B is wrong because CloudWatch Logs can store logs but not generate them. Option C is wrong because Config records resource configuration, not access.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config