DOP-C02 Security and Compliance Practice Test 10 — 15 Questions

Question 1

A company wants to audit all changes to IAM policies in their AWS account. Which THREE services can be used to capture and alert on IAM policy changes? (Choose THREE.)

Accepted Answer

AWS Config. AWS Config is correct because it continuously records resource configuration changes, including IAM policy changes, and can evaluate them against rules or configuration snapshots to detect and audit modifications. AWS CloudTrail is correct because it logs all API activity in the account, including IAM policy creation, modification, and deletion events (e.g., CreatePolicy, PutRolePolicy, AttachRolePolicy), providing the authoritative audit trail. Amazon EventBridge is correct because it can receive CloudTrail management events and match IAM policy change events via event patterns, then route them to targets such as SNS or Lambda for alerting. AWS Trusted Advisor is not correct because it provides best-practice checks and recommendations, not a change audit or alerting mechanism for IAM policies. Amazon Inspector is not correct because it is a vulnerability management service that scans EC2 instances, container images, and Lambda functions, and does not capture IAM policy changes.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Question 2

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. Which AWS service can automatically manage the encryption keys with minimal configuration?

Accepted Answer

SSE-S3. SSE-S3 (Server-Side Encryption with S3-Managed Keys) is the correct answer because it requires minimal configuration: you simply enable it on the bucket or object, and AWS fully manages the encryption keys, including rotation and protection, without any additional setup or key management overhead.

Answer

SSE-C

Answer

SSE-KMS

Answer

Client-side encryption

Question 3

A DevOps engineer needs to ensure that EC2 instances can access an S3 bucket without storing AWS credentials on the instances. Which solution meets this requirement?

Accepted Answer

Attach an IAM role to the EC2 instance with an S3 access policy.. Attaching an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS STS service via the instance metadata service (IMDS). The EC2 instance can then use these credentials to access the S3 bucket without any long-term AWS credentials being stored on the instance. This is the AWS-recommended best practice for granting permissions to AWS services running on EC2.

Answer

Use an S3 bucket policy that grants access to the EC2 instance's public IP.

Answer

Store access keys in the EC2 user data script.

Answer

Create an IAM user and embed credentials in the application code.

Question 4

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). They want to protect against SQL injection and cross-site scripting attacks. Which AWS service should be integrated with the ALB?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that integrates directly with Application Load Balancers to inspect HTTP/HTTPS traffic. It uses managed rule groups to block common attack patterns like SQL injection (e.g., detecting malicious SQL keywords in query strings) and cross-site scripting (e.g., identifying script tags in user input). This makes it the correct choice for protecting web applications at Layer 7.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Question 5

A company's security team requires that all API calls to AWS are logged for audit purposes. Which service should be enabled to capture and store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it is specifically designed to log all API calls made to the AWS environment, including calls made via the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services. CloudTrail captures the identity of the caller, the time of the call, the source IP address, the request parameters, and the response elements, storing this information in a log file that can be delivered to an Amazon S3 bucket for long-term audit storage. This directly meets the security team's requirement to capture and store all API calls for audit purposes.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

Amazon VPC Flow Logs

Question 6

A company wants to enforce that S3 buckets are not publicly accessible. Which AWS service can continuously monitor and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config. AWS Config continuously records resource configuration changes and evaluates them against Config rules, including the managed rule `s3-bucket-public-read-prohibited` and `s3-bucket-public-write-prohibited`. When a bucket becomes non-compliant, Config can trigger an SSM Automation document (via a remediation action) to automatically block public access, making it the service that both monitors and remediates.

Answer

Amazon Macie

Answer

AWS Security Hub

Answer

AWS Trusted Advisor

Question 7

A DevOps engineer needs to grant cross-account access to an S3 bucket in Account A for a user in Account B. Which combination of policies is required?

Accepted Answer

An S3 bucket policy in Account A and an IAM policy in Account B.. Cross-account access to an S3 bucket requires both a resource-based policy (the S3 bucket policy in Account A) that grants the necessary permissions to the principal from Account B, and an identity-based policy (an IAM policy in Account B) attached to the user that allows the S3 actions. The bucket policy explicitly authorizes the external user (by ARN), while the IAM policy ensures the user has the required permissions to initiate the request. Without both, the request will fail due to the lack of either resource-side authorization or identity-side authorization.

Answer

An IAM role in Account A and an IAM policy in Account B.

Answer

Only an IAM policy in Account B.

Answer

Only an S3 bucket policy in Account A.

Question 8

A security audit reveals that an IAM user has long-term access keys that have not been rotated in over 90 days. What is the most secure way to enforce key rotation?

Accepted Answer

Use IAM roles instead of long-term access keys.. A custom Lambda function to rotate keys requires you to build and maintain the rotation logic, permission grants, and secret distribution yourself - AWS IAM has no native, built-in automatic key-rotation feature for access keys, so this approach is at best a partial mitigation with real engineering overhead, and it still leaves long-term static credentials in play between rotations. IAM roles are the superior fix because they remove the need for any long-term key or rotation logic at all.

Answer

Use an AWS Lambda function to automatically rotate keys.

Answer

Manually rotate keys every 90 days.

Answer

Delete the user and create a new one.

Question 9

A company's security policy requires that all data in transit between on-premises and AWS is encrypted. Which AWS service provides a dedicated network connection with encryption?

Accepted Answer

AWS Direct Connect + VPN. AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, and when combined with a VPN over that connection, it adds IPsec encryption. This satisfies the requirement for a dedicated connection with encryption. Direct Connect alone is not encrypted, so the VPN overlay is necessary.

Answer

AWS Transit Gateway

Answer

Amazon VPC peering

Answer

AWS Site-to-Site VPN over the internet

Question 10

A company needs to store audit logs for 7 years to meet compliance requirements. Which S3 storage class is the most cost-effective for long-term archival?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for data accessed less than once per year, with a standard retrieval time of 12 hours and a minimum storage duration of 180 days. For 7-year audit log retention where retrieval is rare and compliance-driven, it is the most cost-effective choice.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 Glacier Flexible Retrieval

Question 11

Which TWO actions should a DevOps engineer take to secure an AWS account root user? (Choose 2.)

Accepted Answer

Delete or disable the root user access keys.. Option C is correct because deleting or disabling the root user's access keys eliminates a long-lived, highly privileged credential that could be used for programmatic access; AWS best practice is to have no access keys on the root user at all. Option E is correct because enabling MFA on the root user adds a second authentication factor, so a compromised password alone cannot be used to sign in to the account's most powerful identity. Options A, B, and D are not appropriate: sharing the root password violates least privilege and accountability, IAM roles cannot be created for or assumed by the root user (roles are for IAM principals), and using root for daily administrative tasks contradicts the practice of using scoped IAM users or roles for routine work.

Answer

Share the root user password with the team.

Answer

Create an IAM role for the root user.

Answer

Use the root user for daily administrative tasks.

Question 12

Which THREE services can be used to protect a VPC from malicious traffic? (Choose 3.)

Accepted Answer

Network ACLs. Network ACLs (NACLs) are stateless, subnet-level firewalls that filter traffic based on rules evaluating source/destination IP, protocol, and port. They provide an additional layer of defense by explicitly allowing or denying inbound and outbound traffic at the subnet boundary, making them a correct choice for protecting a VPC from malicious traffic.

Answer

AWS Shield

Answer

Amazon Route 53 Resolver

Question 13

Which TWO AWS services can be used to centrally manage and enforce security policies across multiple accounts? (Choose 2.)

Accepted Answer

AWS Organizations. AWS Organizations allows you to centrally manage and enforce security policies across multiple accounts by using Service Control Policies (SCPs). SCPs define the maximum permissions for accounts in an organization, enabling you to restrict access to services or actions without requiring per-account configuration. AWS Control Tower provides a managed service that automates the setup of a multi-account environment with pre-built guardrails, which are implemented using SCPs and AWS Config rules to enforce security and compliance policies consistently.

Answer

Amazon S3

Answer

Amazon CloudWatch

Answer

AWS Lambda

Question 14

Refer to the exhibit. A CloudTrail trail named ManagementTrail is configured as shown. Which events will be logged?

Accepted Answer

All management events for the account.. The CloudTrail trail named ManagementTrail is configured to log management events, and by default, when you create a trail in the CloudTrail console, it logs both read and write management events unless you specifically choose to log only one type. The exhibit shows no filtering for read-only or write-only events, so all management events (both read and write) for the account will be logged. This is the standard behavior for a trail that does not have an event selector restricting the event type.

Answer

Only read management events.

Answer

Only write management events.

Answer

Only S3 data events.

Question 15

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with AWS Key Management Service (SSE-KMS) and enforce that all new objects are encrypted. Which bucket policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}. Option C uses the valid condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` to deny `s3:PutObject` if the request does not include the specified KMS key ID. This enforces that all new objects are encrypted with that specific KMS key. Option A is incorrect because `s3:ServerSideEncryption` is not a valid condition key for S3. Option B is incorrect because it uses `StringEquals` instead of `StringNotEquals`, causing it to deny requests that include the specified KMS key, which prevents the use of SSE-KMS. Option D is incorrect because it uses `s3:x-amz-server-side-encryption` with value `AES256`, which enforces SSE-S3, not SSE-KMS.

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:ServerSideEncryption":"awskms"}}}

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:us-east-1:123456789012:key/1234-5678-9012"}}}

Answer

{"Effect":"Deny","Action":"s3:PutObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringNotEquals":{"s3:x-amz-server-side-encryption":"AES256"}}}