DOP-C02 Mock Exam 79 — 25 Questions

Question 1

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The pipeline must scan container images for vulnerabilities before deploying to Amazon ECS. Which service should the engineer use to perform the vulnerability scan?

Accepted Answer

Amazon ECR image scanning. Option B is correct because Amazon ECR can scan images for vulnerabilities. Option A is wrong because AWS WAF is a web application firewall. Option C is wrong because AWS Config is for compliance and resource inventory. Option D is wrong because Amazon GuardDuty is a threat detection service for workloads.

Answer

AWS WAF

Answer

AWS Config

Answer

Amazon GuardDuty

Question 2

A DevOps engineer runs the command above and gets the output shown. The engineer then tries to delete a versioned object from the bucket without using MFA. What will happen?

Accepted Answer

The delete request will fail with an AccessDenied error.. Option C is correct because MFA Delete is enabled, so deleting a versioned object requires MFA. Option A is wrong because versioning is enabled, so objects are not permanently deleted without MFA. Option B is wrong because even though MFA Delete is enabled, it does not prevent listing. Option D is wrong because the delete will fail without MFA.

Answer

The object will be permanently deleted.

Answer

The object will be deleted but can be recovered from the 'Delete Markers' list.

Answer

The object will be deleted and a new version will be created.

Question 3

Given the above IAM policy, which action is permitted?

Accepted Answer

Invoke the Lambda function MyFunction in us-east-1 account 123456789012. The policy explicitly allows the lambda:InvokeFunction action on the specified function ARN. Option A is correct. It does not allow other Lambda actions (B), S3 actions (C), or EC2 actions (D).

Answer

Read objects from an S3 bucket

Answer

Create a Lambda function

Answer

Start an EC2 instance

Question 4

A company is using Amazon RDS for MySQL and needs to encrypt the database at rest. Which action should be taken to enable encryption?

Accepted Answer

Enable encryption when creating the DB instance. Encryption at rest for RDS can only be enabled at creation time. Option B is wrong because encryption cannot be added later. Option C is wrong because enabling encryption on an existing instance is not supported. Option D is wrong because client-side encryption is not native and requires application changes.

Answer

Create a read replica with encryption enabled

Answer

Use AWS Secrets Manager to encrypt the data

Answer

Modify the existing DB instance and enable encryption

Question 5

Refer to the exhibit. A user outside the 192.0.2.0/24 IP range attempts to get an object from example-bucket. What will happen?

Accepted Answer

The request is denied because the Deny statement applies. The Deny statement explicitly denies all S3 actions if the IP is not in the allowed range. Since the user is outside, the Deny applies, overriding the Allow. Option A is wrong because the Deny blocks access. Option B is wrong because the Deny is explicit. Option C is wrong because the policy is not malformed.

Answer

The request is allowed because the Allow statement matches

Answer

The request is allowed because there is no explicit Deny for GetObject

Answer

The request is denied because the policy is malformed

Question 6

A company is using AWS CloudTrail to log API activity. The security team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and alerted. What is the MOST secure and efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the UpdateTrail API call and triggers an SNS notification.. Option C is correct because a CloudWatch Events rule can capture the UpdateTrail API call and trigger an SNS notification for immediate alerting. Option A is wrong because Config rules evaluate resource configurations but do not provide real-time notifications. Option B is wrong because GuardDuty focuses on threat detection, not configuration changes. Option D is wrong because Trusted Advisor provides best-practice checks but not real-time alerts.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration and email the security team.

Answer

Enable Amazon GuardDuty and configure a custom threat list to monitor CloudTrail API calls.

Answer

Create an AWS Config rule to detect changes to CloudTrail configuration and send an SNS notification.

Question 7

A company uses AWS KMS to encrypt data at rest in S3. The security team wants to ensure that KMS keys are rotated automatically every year. Which THREE steps should be taken?

Accepted Answer

Create a CloudWatch Events rule to notify the security team before the rotation date.. Option A is correct because automatic key rotation is enabled in KMS for symmetric keys. Option B is correct because key rotation rotates the backing key while keeping the same key ID. Option C is correct because a CloudWatch Events rule can notify before rotation. Option D is wrong because manual rotation creates a new key, which is not automatic. Option E is wrong because S3 bucket policy does not manage key rotation.

Answer

Configure an S3 bucket policy to enforce key rotation.

Answer

Ensure the key policy allows the kms:RotateKeyOnDemand action.

Answer

Create a new KMS key every year and update the application to use the new key.

Question 8

A company is deploying a web application on AWS and needs to ensure that all traffic to the application is encrypted in transit. The application runs behind an Application Load Balancer (ALB). Which configuration should be used to enforce HTTPS-only access?

Accepted Answer

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.. Option B is correct because the ALB can be configured with an HTTPS listener that redirects HTTP traffic to HTTPS, ensuring encrypted transit. Option A is wrong because security groups only control traffic at the instance level, not the ALB listener. Option C is wrong because CloudFront can enforce HTTPS but adds complexity and cost. Option D is wrong because modifying the application code is not a scalable or secure approach compared to ALB-level enforcement.

Answer

Configure the web server on the EC2 instances to only respond to HTTPS requests.

Answer

Configure the security group of the ALB to only allow inbound HTTPS traffic.

Answer

Use AWS CloudFront with a custom SSL certificate and set the viewer protocol policy to Redirect HTTP to HTTPS.

Question 9

A DevOps engineer needs to securely store database credentials for an application running on Amazon ECS. Which AWS service should be used to manage the credentials and provide them to the ECS tasks?

Accepted Answer

AWS Secrets Manager. Option C is correct because AWS Secrets Manager is designed to securely store and rotate secrets, and can be integrated with ECS via task roles. Option A is wrong because Parameter Store can store parameters but is not as focused on secrets management. Option B is wrong because Systems Manager is broader and not specifically for secrets. Option D is wrong because S3 is not secure for storing secrets without encryption and access control.

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager

Answer

AWS Systems Manager Parameter Store

Question 10

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS. Which approach should be used to ensure compliance?

Accepted Answer

Attach a service control policy (SCP) to all accounts that denies s3:PutBucketEncryption or s3:PutObject without encryption.. Option D is correct because a service control policy (SCP) can deny actions that create or modify S3 buckets without encryption. Option A is wrong because Config rules only detect non-compliance, they don't enforce. Option B is wrong because bucket policies are per-bucket and cannot be applied globally. Option C is wrong because an IAM policy in the master account does not affect member accounts.

Answer

Apply an S3 bucket policy on each account's buckets to deny unencrypted object uploads.

Answer

Create an IAM policy in the master account that denies S3:PutObject without encryption.

Answer

Use AWS Config rules to evaluate S3 bucket encryption and trigger a remediation action via AWS Systems Manager Automation.

Question 11

A company uses AWS CodePipeline to deploy applications. The pipeline must deploy to an Amazon ECS cluster. The security team requires that all deployment actions be logged and auditable. Which configuration should be used?

Accepted Answer

Enable AWS CloudTrail to record all API calls made by CodePipeline.. Option B is correct because CloudTrail logs all API calls, including those from CodePipeline. Option A is wrong because VPC Flow Logs log network traffic, not deployment actions. Option C is wrong because CloudWatch Logs logs application logs, not API calls. Option D is wrong because S3 access logs log requests to S3, not pipeline actions.

Answer

Enable VPC Flow Logs for the ECS cluster's VPC.

Answer

Enable Amazon S3 server access logs for the artifact bucket used by CodePipeline.

Answer

Enable Amazon CloudWatch Logs for the CodePipeline.

Question 12

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. What should be done? (Choose TWO.)

Accepted Answer

Modify the KMS key policy to include a condition that requires the kms:ViaService to be from the VPC endpoint.. Options B and C are correct. A VPC endpoint for KMS allows private connectivity. A key policy with a condition for the VPC endpoint restricts usage. Option A is wrong because SCPs cannot restrict KMS key usage. Option D is wrong because bucket policies cannot restrict KMS key usage. Option E is wrong because security groups do not apply to KMS.

Answer

Attach a security group to the KMS key.

Answer

Configure the S3 bucket policy to allow only requests from the VPC.

Answer

Create a service control policy (SCP) that denies KMS operations from outside the VPC.

Question 13

A DevOps engineer needs to rotate database credentials stored in AWS Secrets Manager automatically every 30 days. What is the simplest way to achieve this?

Accepted Answer

Enable automatic rotation in Secrets Manager with a rotation interval of 30 days.. Option A is correct because Secrets Manager has built-in automatic rotation with customizable rotation intervals. Option B is wrong because Lambda functions are used for custom rotation, not automatic. Option C is wrong because Parameter Store does not support automatic rotation. Option D is wrong because CloudWatch Events can trigger rotation but the simplest way is to use Secrets Manager's built-in feature.

Answer

Store the credentials in Systems Manager Parameter Store and use a scheduled automation to update them.

Answer

Create a CloudWatch Events rule that triggers a Lambda function to rotate the secret.

Answer

Write a custom Lambda function that rotates the secret and schedule it with CloudWatch Events.

Question 14

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to download an object from the S3 bucket 'example-bucket' from an IP address of 10.1.2.3. What will happen?

Accepted Answer

The request is allowed because the condition matches the IP address.. Option B is correct because the policy allows s3:GetObject only if the condition matches. The IP 10.1.2.3 falls within 10.0.0.0/8, so the condition is satisfied. Option A is wrong because the condition is met. Option C is wrong because the policy does not specify a Deny. Option D is wrong because the bucket policy is not shown.

Answer

The request is denied because the policy does not include a Deny statement.

Answer

The request is denied because the policy does not explicitly allow the action.

Answer

The result depends on the bucket policy.

Question 15

A DevOps engineer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline deploys a critical application. Which security practice should the engineer implement to prevent unauthorized changes to the pipeline?

Accepted Answer

Attach an IAM policy that uses a condition to allow only specific users or roles to modify the pipeline. Using IAM conditions to restrict pipeline modifications to authorized users. Option A is wrong because CloudWatch Events detect changes but don't prevent them. Option B is wrong because pipeline notifications inform but don't prevent. Option D is wrong because encrypting artifacts doesn't prevent pipeline changes.

Answer

Encrypt the pipeline artifacts using AWS KMS

Answer

Use SNS to send notifications when the pipeline is updated

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to notify on pipeline changes

Question 16

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet but must not be directly accessible from the internet. Which configuration allows this?

Accepted Answer

Deploy a NAT gateway in a public subnet and route the private subnet's traffic through it.. A NAT gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections. Option C is correct. Option A is wrong because an internet gateway alone does not provide outbound-only access for private instances. Option B is wrong because a bastion host only provides SSH/RDP access, not general internet access. Option D is wrong because a VPN connection does not provide direct internet access.

Answer

Set up a VPN connection to the company's on-premises network and route traffic through it.

Answer

Deploy a bastion host in the public subnet and configure the instance to use it.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet route table.

Question 17

Which TWO actions are effective ways to protect an AWS account root user? (Choose 2)

Accepted Answer

Enable multi-factor authentication (MFA) on the root user.. Option A (MFA) and Option C (no access keys) are correct. Option B is wrong because a strong password alone is not sufficient; MFA is critical. Option D is wrong because using root user regularly increases risk. Option E is wrong because a single password change is not a protection mechanism.

Answer

Use a strong, complex password and change it every 90 days.

Answer

Use the root user for everyday administrative tasks.

Answer

Rotate the root user password every 30 days.

Question 18

A DevOps engineer is troubleshooting a failed CodeBuild project. The build fails with an error: 'Access Denied: Unable to put object to S3.' The build project has an S3 bucket as the artifact store. What should the engineer do to resolve this issue?

Accepted Answer

Add s3:PutObject permission to the CodeBuild service role for the artifact bucket.. Option A is correct because the CodeBuild service role needs s3:PutObject permission. Option B is wrong because the issue is about writing artifacts, not reading source. Option C is wrong because CloudWatch Logs is for logs, not artifacts. Option D is wrong because KMS is for encryption, not direct write permission.

Answer

Enable server-side encryption on the artifact bucket.

Answer

Enable CloudWatch Logs for the build project.

Answer

Add s3:GetObject permission to the CodeBuild service role for the source bucket.

Question 19

A company needs to audit all changes to security groups in a multi-account environment. The logs must be centrally stored and immutable. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Enable AWS CloudTrail in all accounts, deliver logs to a central S3 bucket with S3 Object Lock enabled. AWS CloudTrail logs all API calls, including security group changes. Sending CloudTrail logs from all accounts to a central S3 bucket with Object Lock enabled ensures immutability. Option A is correct. Option B (AWS Config) records state changes but not API calls. Option C (VPC Flow Logs) logs network traffic, not security group changes. Option D (Amazon GuardDuty) is for threat detection.

Answer

Enable VPC Flow Logs in each VPC and aggregate them in Amazon CloudWatch Logs

Answer

Enable Amazon GuardDuty and send findings to a central S3 bucket

Answer

Enable AWS Config rules to detect security group changes and store results in a central S3 bucket

Question 20

Which TWO measures can be taken to protect data at rest in Amazon S3? (Select TWO.)

Accepted Answer

Enable S3 Server-Side Encryption (SSE-S3 or SSE-KMS). S3 Server-Side Encryption (SSE) and S3 Bucket Policies to deny unencrypted PUT requests are measures to protect data at rest. MFA Delete protects against accidental deletion, not encryption. Cross-region replication is for disaster recovery. S3 Transfer Acceleration speeds up uploads.

Answer

Enable cross-region replication

Answer

Enable MFA Delete on the bucket

Answer

Use S3 Transfer Acceleration