DOP-C02 Mock Exam 80 — 25 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants to centrally enforce that S3 buckets in all accounts block public access. Which policy should be attached to the root organizational unit to achieve this?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit.. Service control policies (SCPs) can be applied to organizational units to restrict permissions across member accounts. Option B is correct because SCPs allow denial of actions that would make S3 buckets public. Option A is wrong because IAM policies are account-specific and cannot be applied centrally to all accounts. Option C is wrong because AWS Config rules can detect but not enforce. Option D is wrong because a bucket policy is per-bucket and cannot be applied globally.

Answer

Configure a bucket policy on each S3 bucket to deny public access.

Answer

Create an AWS Config rule to mark noncompliant buckets.

Answer

Attach an IAM policy to the root user of each account.

Question 2

A company is using AWS CodePipeline with an S3 source action. The pipeline must be triggered only when a new object is uploaded to a specific prefix, and the pipeline should not have access to objects outside that prefix. Which configuration meets these requirements?

Accepted Answer

Configure the S3 source action with a CloudWatch event that has a prefix filter, and attach an IAM policy to the pipeline role that allows only the specific prefix.. Using an S3 CloudWatch event with a prefix filter and a resource policy on the S3 bucket that restricts access to the prefix ensures both conditions. Option D is correct. Option A is wrong because a single S3 event without prefix filter would trigger on all objects. Option B is wrong because a bucket policy allowing only the prefix does not restrict the pipeline's IAM role. Option C is wrong because the S3 source action by default has access to the entire bucket.

Answer

Use an S3 event notification to trigger a Lambda function that starts the pipeline.

Answer

Configure the S3 source action with a specific object key and use a bucket policy to allow only that key.

Answer

Use a separate S3 bucket for the pipeline's source artifacts.

Question 3

A DevOps engineer needs to store database credentials for an application running on Amazon ECS. The credentials must be automatically rotated every 30 days and encrypted at rest. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store credentials in AWS Secrets Manager and configure automatic rotation.. AWS Secrets Manager provides built-in automatic rotation and encryption using AWS KMS. Option A is correct. Option B is wrong because Parameter Store does not support automatic rotation natively. Option C is wrong because manual rotation increases overhead. Option D is wrong because storing in environment variables is insecure and does not rotate.

Answer

Store credentials in AWS Systems Manager Parameter Store as SecureString.

Answer

Encrypt credentials with AWS KMS and store them in a versioned S3 bucket.

Answer

Embed credentials as environment variables in the ECS task definition.

Question 4

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic to the ALB must be encrypted (HTTPS) and that the ALB must only accept traffic from CloudFront. The DevOps engineer has configured CloudFront with an origin pointing to the ALB, and the ALB has a listener on port 443 with a valid SSL certificate. The engineer also added a security group rule to the ALB that allows HTTPS traffic only from CloudFront's IP ranges. However, users are reporting intermittent 503 errors. The engineer checks CloudFront logs and sees that some requests are failing with 'Origin Connect Error'. What is the most likely cause?

Accepted Answer

The security group rule is using an outdated list of CloudFront IP ranges, and CloudFront has added new IP ranges that are being blocked.. CloudFront uses a large set of IP addresses that change over time. Using a security group with a static list of CloudFront IPs is not recommended because the IPs change. Instead, the ALB should use a custom header that CloudFront adds. Option A is correct: the security group blocks new CloudFront IPs not in the list. Option B (SSL mismatch) would cause a different error. Option C (timeout) would be more consistent. Option D (WAF) would return 403, not 503.

Answer

The ALB has a Web Application Firewall (WAF) that is blocking requests from CloudFront.

Answer

The SSL certificate on the ALB is not trusted by CloudFront, causing handshake failures.

Answer

The ALB idle timeout is set too low, causing CloudFront to close connections prematurely.

Question 5

A company uses AWS CodeBuild for CI/CD. The build project needs to access a private S3 bucket to download artifacts. What is the MOST secure way to grant access?

Accepted Answer

Create an IAM role with read access to the bucket and attach it to the CodeBuild project.. Using an IAM role with a trust policy for CodeBuild is the most secure method because it avoids long-term credentials. Option B is correct. Option A is wrong because storing access keys in environment variables is less secure. Option C is wrong because embedding keys in the buildspec file is insecure. Option D is wrong because bucket policies can be used but require the principal to be an IAM user/role; still, the build project should use a role.

Answer

Embed the access keys in the buildspec.yml file.

Answer

Use an S3 bucket policy that grants public read access.

Answer

Store AWS access keys in CodeBuild environment variables.

Question 6

An IAM policy is attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' even though they are connecting from within the 10.0.0.0/16 IP range. What is the MOST likely reason?

Accepted Answer

The user is accessing S3 through a VPC endpoint, but the condition only works for public IP addresses.. The condition 'aws:SourceIp' evaluates the IP address of the requester. However, if the user is accessing S3 through a VPC endpoint, the source IP is a private IP from the VPC, but the condition works only for public IP addresses. Option C is correct. Option A is wrong because the policy allows GetObject. Option B is wrong because the resource is correct. Option D is wrong because the condition is for source IP, not VPC endpoint.

Answer

The policy needs an additional condition for VPC endpoint.

Answer

The policy does not allow the s3:ListBucket action.

Answer

The resource ARN is missing the bucket-level permission.

Question 7

An organization wants to enforce that all Amazon S3 buckets are encrypted with SSE-S3. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config rules with auto-remediation. Option D is correct because AWS Config with managed rules and auto-remediation can enforce encryption. Option A is wrong because IAM can deny non-encrypted put, but not remediate existing buckets. Option B is wrong because CloudTrail is for logging. Option C is wrong because Service Catalog is for provisioning approved resources.

Answer

AWS CloudTrail

Answer

IAM policies

Answer

AWS Service Catalog

Question 8

A DevOps engineer needs to grant cross-account access to an S3 bucket. The source account is 111111111111 and the target account is 222222222222. Which combination of a bucket policy and an IAM policy correctly grants the target account access?

Accepted Answer

Bucket policy: { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::222222222222:root" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" }. Cross-account S3 access requires a bucket policy in the source account that grants permissions to the target account's root or a specific role, and an IAM policy in the target account that allows the user to access the bucket. Option A is correct. Option B is missing the bucket policy. Option C is missing the IAM policy. Option D uses an incorrect syntax.

Answer

Bucket policy: { "Effect": "Allow", "Principal": "222222222222", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: same as A

Answer

Only bucket policy as in A

Answer

Only IAM policy as in A

Question 9

An S3 bucket has the above bucket policy. What is the net effect on GetObject requests?

Accepted Answer

Only requests from IP range 192.0.2.0/24 are allowed. The Allow statement grants public read access. The Deny statement denies all S3 actions when the source IP is not in 192.0.2.0/24. Since a Deny overrides an Allow, only requests from within that IP range are allowed. Option C is correct.

Answer

All anonymous users can read objects

Answer

All requests are denied

Answer

Only authenticated users can read objects

Question 10

A security audit reveals that an S3 bucket contains objects that are not encrypted. The bucket is configured with default encryption using SSE-S3. What is the most likely reason that objects are unencrypted?

Accepted Answer

The objects were uploaded before default encryption was enabled. Default encryption applies only to newly uploaded objects that do not have encryption settings. If objects were uploaded before default encryption was enabled, or if the PUT request explicitly specified no encryption, they may remain unencrypted. Option A is wrong because SSE-S3 does not require KMS. Option B is wrong because default encryption applies to new objects. Option D is wrong because SSE-C is not relevant.

Answer

The objects were uploaded with server-side encryption using AWS KMS

Answer

The bucket policy denies SSE-S3 encryption

Answer

The objects were uploaded with SSE-C

Question 11

A DevOps engineer needs to securely store and automatically rotate database credentials for a MySQL RDS instance. The credentials should be accessible to a Lambda function without hardcoding them. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager provides the ability to store secrets and automatically rotate them for RDS databases. It also integrates with Lambda via the Secrets Manager API to retrieve secrets at runtime. Option A is wrong because Parameter Store can store secrets but does not support automatic rotation for RDS. Option B is wrong because KMS is for encryption keys, not secret storage. Option D is wrong because IAM roles cannot store credentials; they provide permissions.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

IAM roles for EC2

Question 12

A key policy for a KMS customer managed key includes the above statement. An IAM role 'AdminRole' in account 123456789012 is allowed to decrypt. However, when the role attempts to decrypt data, it receives an access denied error. What is the MOST likely cause?

Accepted Answer

The condition 'kms:GrantIsForAWSResource' is preventing direct API calls.. The condition 'kms:GrantIsForAWSResource' restricts the permission to requests that come from AWS services that integrate with KMS, not from direct API calls by the role. Option B is correct. Option A is wrong because the principal is correctly specified. Option C is wrong because the action is correct. Option D is wrong because the wildcard resource is fine for KMS key policies.

Answer

The action should be 'kms:Decrypt*'.

Answer

The resource should be the key ARN, not '*'.

Answer

The principal ARN is incorrect.

Question 13

A DevOps engineer needs to temporarily grant an external auditor read-only access to a specific S3 bucket for 24 hours. What is the most secure way to grant this access?

Accepted Answer

Generate a pre-signed URL for the objects and share the URL with the auditor.. Option B is correct because a pre-signed URL grants time-limited access without sharing credentials. Option A is wrong because attaching a policy directly to the user grants permanent access. Option C is wrong because bucket policies are permanent. Option D is wrong because sharing access keys violates security best practices.

Answer

Create an IAM user with a policy granting read-only access to the bucket.

Answer

Add a bucket policy that grants read-only access to the auditor's AWS account.

Answer

Share the access keys of an existing IAM user with the auditor.

Question 14

Given the above AWS CLI command output, which actions are allowed for the specified policy?

Accepted Answer

ec2:DescribeInstances and s3:GetObject are allowed; s3:ListBucket is denied. The simulate-custom-policy command tests the specified policy against the given actions and resources. For ec2:DescribeInstances, the action is allowed (ec2:Describe* covers it). For s3:GetObject, the action is allowed. For s3:ListBucket, the action is not allowed because the policy only allows s3:GetObject, not s3:ListBucket. So two actions are allowed. Option A is correct.

Answer

Only s3:GetObject is allowed

Answer

Only ec2:DescribeInstances is allowed

Answer

All three actions are allowed

Question 15

A company needs to enforce that all EC2 instances launched in an AWS account use a specific Amazon Machine Image (AMI) that is approved by the security team. Which combination of services should be used?

Accepted Answer

AWS Config rule to check AMI ID and AWS Systems Manager Automation to remediate non-compliant instances. AWS Config can detect non-compliant instances and AWS Systems Manager Automation can automatically remediate by stopping or terminating them. Option B is correct. Option A (SCP) cannot enforce AMI IDs. Option C (CloudTrail) only logs. Option D (Lambda) could be used but is not the primary service.

Answer

AWS Organizations SCP and AWS CloudTrail

Answer

AWS Lambda and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Events

Question 16

A company has a requirement to store audit logs for 7 years. The logs are currently stored in Amazon S3 and are accessed infrequently. Which storage class provides the lowest cost while meeting the retention requirement?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class for long-term retention of data that is accessed rarely. Option A (S3 Standard) is expensive for long-term. Option B (S3 Intelligent-Tiering) may move data but has monitoring costs. Option D (S3 One Zone-IA) is not for long-term durability.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 One Zone-Infrequent Access

Question 17

A company uses AWS CodeBuild to build and test code. The build process requires access to a private PyPI repository hosted on an internal network. The CodeBuild project is configured with a VPC. However, the build fails with a timeout error when trying to connect to the PyPI repository. The security group for the CodeBuild project allows outbound HTTPS to 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The security group for the PyPI repository does not allow inbound traffic from the CodeBuild security group.. The private PyPI repository is in the internal network, which is likely accessible via a VPC. However, if the repository's security group does not allow inbound traffic from the CodeBuild security group, the connection will be blocked. The CodeBuild project's outbound rules are correct, but the repository side needs to allow inbound. Option A is wrong because the subnet must have a route to the internal network, which is usually via a VPC peering or VPN. Option C is wrong because if the subnet has a NAT gateway, the traffic would go to the internet, not to the internal network. Option D is wrong because a VPC endpoint is for AWS services, not for on-premises resources.

Answer

CodeBuild does not support VPC connectivity.

Answer

The VPC subnet has a NAT gateway that routes traffic to the internet instead of the internal network.

Answer

The VPC subnet does not have a route to the internal network.

Question 18

A company needs to enforce that all IAM users must use multi-factor authentication (MFA) to perform any AWS Console actions. Which TWO steps should be taken to enforce this?

Accepted Answer

Attach the policy to all IAM users or a group containing all users. To enforce MFA, you need an IAM policy that denies actions if MFA is not present, and you must attach that policy to all users or a group. Creating an SCP can enforce across accounts but is not needed for single account. CloudTrail does not enforce. Account alias is unrelated.

Answer

Create an SCP in AWS Organizations

Answer

Set an account alias for the root user

Answer

Enable CloudTrail to log MFA usage

Question 19

A security engineer runs the above CLI command to investigate IAM user 'Bob'. The output shows Bob logged in and then created a new IAM user. Which additional information should the engineer look for to determine if this was a security incident?

Accepted Answer

The source IP address from the CloudTrail event details.. To determine if the activity is malicious, the engineer should check the source IP address from the CloudTrail event details. Option B is correct. Option A is wrong because the event name is already known. Option C is wrong because CloudTrail does not log the timestamp of the resource's last modification. Option D is wrong because the IAM user's group membership is not directly relevant to the login event.

Answer

The event name for the user creation.

Answer

The time the new user was last modified.

Answer

The IAM group memberships of the new user.

Question 20

A DevOps engineer is designing a secure CI/CD pipeline. Which TWO of the following are best practices for securing secrets in the pipeline?

Accepted Answer

Use encrypted environment variables in CodeBuild.. Options A and D are correct because AWS Secrets Manager is a secure service for storing secrets, and environment variables in CodeBuild can be encrypted. Option B is wrong because storing secrets in source code is insecure. Option C is wrong because S3 bucket policies do not encrypt secrets. Option E is wrong because hardcoding secrets in CloudFormation templates is insecure.

Answer

Store secrets in a parameter file in the source repository.

Answer

Hardcode secrets in CloudFormation template parameters.

Answer

Use S3 bucket policies to restrict access to secret files.