DOP-C02 Security and Compliance Practice Test 10 — 15 Questions

Question 1

A company uses AWS Lambda functions to process sensitive data from an SQS queue. The Lambda function writes results to an S3 bucket. The security team requires that all data at rest in S3 be encrypted with a customer managed KMS key, and that the Lambda function only have access to decrypt the queue messages and encrypt the S3 objects. An IAM role is attached to the Lambda function. The engineer has configured the KMS key policy to allow the Lambda role to use the key. However, the Lambda function fails to write to S3 with a 'KMS access denied' error. The engineer verified that the S3 bucket has default encryption enabled with the same KMS key. Which additional step is most likely required?

Accepted Answer

Add an inline policy to the Lambda role that allows kms:GenerateDataKey and kms:Encrypt actions for the KMS key.. Even if the S3 bucket has default encryption, the Lambda function needs kms:GenerateDataKey permission (or kms:Encrypt) in its IAM role to encrypt objects when writing. The key policy allows the role, but the role's permissions policy must also include the necessary KMS actions. The error indicates that the role lacks the appropriate KMS action.

Answer

Disable default encryption on the S3 bucket and configure the Lambda to use SSE-S3.

Answer

Grant the Lambda role s3:PutObject permission on the bucket.

Answer

Modify the KMS key policy to allow the Lambda role to use the key without any conditions.

Question 2

A startup wants to provide temporary, limited-privilege AWS access to external contractors who will assist with a project. The contractors do not have AWS accounts. The company wants to avoid creating IAM users for each contractor. They need a solution that allows contractors to log in to the AWS Management Console for a limited time. Which AWS service should the engineer use?

Accepted Answer

Use AWS SSO with an external identity provider, and grant access to an AWS account with a permission set.. AWS SSO can be used to grant external users access to AWS accounts via a portal, with temporary credentials. You can invite users as external members in AWS SSO, and they can log in with their own email and receive temporary credentials. IAM roles cannot be directly assumed without AWS credentials. Cognito is for app users. IAM users would require creating permanent users.

Answer

Create IAM users for each contractor and attach a policy with a condition to expire access after the project.

Answer

Use Amazon Cognito user pools to create temporary user accounts.

Answer

Provide the contractors with the root user credentials of a separate AWS account.

Question 3

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). The application uses HTTPS. The security team wants to ensure that all traffic between the ALB and the instances is encrypted. The instances currently use a self-signed certificate for the backend HTTPS listener. The engineer notices that the ALB health checks are failing, and the error message indicates 'TLS handshake failed'. The health check is configured as HTTPS. What should the engineer do to resolve the health check failure while maintaining encryption?

Accepted Answer

Install a valid certificate from AWS Certificate Manager (ACM) on each EC2 instance and configure the ALB target group to use HTTPS with that certificate.. The ALB health check expects a valid certificate from the target. Self-signed certificates cause health checks to fail unless the ALB is configured to ignore certificate verification. The ALB can be configured to verify or skip verification. To fix, the engineer should either configure the target group to use HTTP for health checks (while using HTTPS for data traffic) or configure the target group to use HTTPS with a certificate that the ALB trusts (e.g., from ACM). The simplest is to use HTTP health checks, but the requirement is to maintain encryption. However, health checks can be over HTTP if the data traffic uses HTTPS. Alternatively, the engineer can install a certificate from ACM on the instances, but that is more complex. The most practical solution is to use HTTP for health checks (which is not encrypted) but the question says maintain encryption. The best answer is to install a trusted certificate (e.g., from ACM) on the instances.

Answer

Change the health check to use HTTP on port 80 and allow HTTP traffic from the ALB to the instances.

Answer

Configure the ALB to ignore certificate verification for health checks by setting the health check protocol to HTTPS and enabling 'ignore certificate' option.

Answer

Disable health checks on the ALB and rely on CloudWatch alarms to detect instance failures.

Question 4

A company wants to enable AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team requires that logs be encrypted at rest and that any unauthorized deletion of log files be prevented. Which TWO actions should the security team take? (Choose TWO.)

Accepted Answer

Create a trail in the management account that applies to all accounts in the organization.. Option A is correct because enabling CloudTrail for all accounts in the organization ensures centralized logging. Option D is correct because S3 Object Lock prevents deletion of log files. Option B is incorrect because KMS with a customer managed key provides encryption, but the key must be created beforehand, not just enabled. Option C is incorrect because CloudWatch Logs encryption uses KMS, not S3 SSE. Option E is incorrect because CloudTrail can be configured to log management events by default, and this is not about data events.

Answer

Enable default encryption with SSE-S3 on the S3 bucket where CloudTrail delivers logs.

Answer

Configure CloudTrail to send logs to Amazon CloudWatch Logs and enable encryption using an AWS KMS key.

Answer

Enable CloudTrail Insights to detect unusual API activity.

Question 5

A company uses AWS CodePipeline for CI/CD. The security team requires that all code changes be scanned for secrets before deployment. The pipeline consists of a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The security team wants to automatically scan for secrets and block the pipeline if any secrets are found. Which THREE actions should the team take? (Choose THREE.)

Accepted Answer

Configure the build project to fail the build if the scanning tool returns a non-zero exit code.. Option A is correct because using a scanning action in the build stage can catch secrets. Option C is correct because CodeBuild can fail the build if secrets are found, preventing deployment. Option E is correct because IAM permissions are needed for CodeBuild to access the scanning tool. Option B is incorrect because S3 bucket policies are not relevant. Option D is incorrect because post-deployment scanning would not block the pipeline before deployment.

Answer

Add a scanning action in the deploy stage to scan after deployment.

Answer

Configure an S3 bucket policy to deny access if secrets are detected.

Question 6

A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer (ALB). The application uses an RDS MySQL database. The security team performed a penetration test and discovered that the application is vulnerable to SQL injection. The development team has deployed a WAF web ACL to the ALB that includes rules to block SQL injection attacks. However, after the deployment, the application started returning 403 errors for legitimate requests, and the security team needs to investigate. The team also wants to ensure that only approved AWS services can access the RDS database. The current security groups are configured with a rule that allows inbound traffic from the ALB security group to the RDS database on port 3306. Which combination of actions should the security team take to resolve the issue and improve the security posture?

Accepted Answer

Switch the WAF web ACL to count mode while tuning the rules, and implement an IAM policy to restrict database access to specific AWS services using the aws:SourceArn condition key.. Option C is correct because counting mode allows the team to see which requests would be blocked without actually blocking them, allowing fine-tuning of the WAF rules. Also, using an IAM policy with condition keys to restrict access to the database from only approved services (like Lambda or specific EC2 instances) adds a layer of defense. Option A is incorrect because disabling the WAF rule is not a security best practice; it would leave the application vulnerable. Option B is incorrect because adding a second ALB does not solve the problem and increases complexity. Option D is incorrect because allowing all traffic to the database from the VPC defeats the purpose of security groups and increases the attack surface.

Answer

Disable the WAF rules that are causing false positives and add network ACLs to block all traffic to the database except from the ALB.

Answer

Remove the WAF web ACL and rely on security group ingress rules that allow all traffic from the VPC CIDR to the database.

Answer

Switch the WAF web ACL to count mode and add a second ALB in front of the database to filter traffic.

Question 7

A company uses AWS Lambda to process sensitive data stored in Amazon S3. The Lambda function is triggered by S3 object creation events. The security team requires that all data in transit be encrypted using TLS 1.2 or higher. The Lambda function currently uses the AWS SDK to download objects from S3 using HTTP (not HTTPS). The team also needs to ensure that the Lambda function only accesses S3 objects that are encrypted with a specific AWS KMS key. The Lambda execution role already has permissions to decrypt with that KMS key. Which combination of actions should the security team take to meet the requirements?

Accepted Answer

Configure the Lambda function to use HTTPS when calling S3, and add a bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match the specific KMS key.. Option B is correct because configuring the S3 client to use HTTPS and setting the endpoint to use TLS 1.2 ensures encryption in transit. Additionally, using an S3 bucket policy with a condition that requires the presence of the specific KMS key encrypts the object and restricts access. Option A is incorrect because S3 does not support VPC endpoints for TLS enforcement; VPC endpoints use AWS PrivateLink but do not enforce TLS version. Option C is incorrect because CloudFront does not enforce TLS 1.2 by default and adds complexity. Option D is incorrect because enabling default encryption does not enforce TLS 1.2 for connections.

Answer

Configure the Lambda function to use a VPC endpoint for S3, and update the bucket policy to deny requests that do not use TLS 1.2.

Answer

Enable default encryption on the S3 bucket using the specific KMS key, and update the Lambda function to use the AWS SDK's default client, which uses HTTPS.

Answer

Place a CloudFront distribution in front of the S3 bucket, and configure the Lambda function to access S3 through CloudFront using HTTPS.

Question 8

A company uses AWS CloudFormation to manage infrastructure as code. The security team requires that all changes to CloudFormation stacks be reviewed and approved before execution. The team has enabled StackSets to deploy stacks across multiple accounts. A junior developer accidentally runs a stack update that modifies a production security group, opening SSH access to 0.0.0.0/0. The security team wants to prevent this type of incident in the future. They need a solution that enforces a mandatory approval workflow for all stack updates, while still allowing automated deployments from approved CI/CD pipelines. Which solution meets these requirements?

Accepted Answer

Create an IAM policy that denies cloudformation:UpdateStack unless the request is made using a specific service role with a path /ci-cp/, and configure the CI/CD pipeline to assume that role.. Option C is correct because using a service role with a specific path and condition in the IAM policy ensures that only approved CI/CD roles can assume the service role to perform stack operations. Additionally, using StackSets with approval workflows via Service Catalog or custom approval steps can enforce review. Option A is incorrect because enabling termination protection does not prevent updates. Option B is incorrect because using a change set with manual approval is not automated and does not prevent the developer from using the same role to execute the change set without approval. Option D is incorrect because IAM policies cannot prevent a user from making changes directly; they can only allow or deny actions. A blanket deny would block all updates.

Answer

Use CloudFormation change sets and require that they be manually executed by a senior engineer.

Answer

Attach a resource-based policy to the stack that denies updates from any principal that does not have a specific tag.

Answer

Enable termination protection on all production stacks and require MFA for stack updates.

Question 9

A company uses Amazon Inspector to assess the security of EC2 instances. The security team receives an alert that a high-severity vulnerability (CVE-2023-XXXX) was found on an EC2 instance running a critical application. The application is behind an Application Load Balancer (ALB) and uses an Auto Scaling group. The vulnerability has a known patch, but patching requires a reboot. The security team needs to remediate the vulnerability with minimal downtime. Which approach should the team take?

Accepted Answer

Create a new launch template with an updated AMI that includes the patch. Update the Auto Scaling group to use the new launch template and perform a rolling update.. Option A is correct because creating a new launch template with the patched AMI, updating the Auto Scaling group, and performing a rolling update ensures that instances are replaced with minimal downtime. Option B is incorrect because stopping and patching the instance would cause downtime for that specific instance, and it may not be in the Auto Scaling group. Option C is incorrect because using the same AMI but applying a patch user data script may not work reliably and does not ensure a clean state. Option D is incorrect because disabling the ALB health check would cause traffic to be sent to the vulnerable instance, increasing risk.

Answer

Remove the instance from the Auto Scaling group, disable health checks on the ALB, and apply the patch manually.

Answer

Use AWS Systems Manager Patch Manager to apply the patch on the instance without rebooting, then verify the vulnerability is resolved.

Answer

Stop the vulnerable instance, apply the patch, and start it again. Re-register it with the ALB.

Question 10

A company uses AWS Secrets Manager to store database credentials. The security team wants to automatically rotate secrets every 30 days. The database is an Amazon RDS for PostgreSQL instance. The team has configured automatic rotation with a Lambda function that updates the password in RDS and Secrets Manager. However, after the first rotation, the application starts getting database connection errors. The application uses a connection string with the secret ARN and retrieves the secret from Secrets Manager at startup using the AWS SDK. Which of the following is the most likely cause of the connection errors?

Accepted Answer

The application caches the secret at startup and does not refresh it after rotation.. Option B is correct because if the application caches the secret, it will not pick up the new password after rotation, leading to connection errors. Option A is incorrect because RDS automatic password rotation is not a feature; Secrets Manager handles rotation. Option C is incorrect because KMS permissions are needed to decrypt the secret, but if the application could access the secret initially, it likely has permissions. Option D is incorrect because Lambda function concurrency is unlikely to cause connection errors; it would affect the rotation process itself.

Answer

The Lambda function is not configured with a sufficient timeout and is being throttled.

Answer

The Lambda function does not have permission to update the secret in Secrets Manager.

Answer

The RDS instance has automatic password rotation enabled, which conflicts with Secrets Manager rotation.

Question 11

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts are encrypted with AES-256 (SSE-S3) and that public access is blocked. The team wants to use a preventive control that automatically remediates non-compliant buckets. Which solution should the security team implement?

Accepted Answer

Create a Service Control Policy (SCP) that denies s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption if the bucket is not configured correctly.. Option C is correct because an SCP can deny actions that create or modify buckets without encryption or with public access enabled. This is a preventive control that applies to all accounts in the organization. Option A is incorrect because AWS Config rules are detective, not preventive; they can trigger auto-remediation but after the fact. Option B is incorrect because CloudTrail is for logging, not enforcement. Option D is incorrect because Service Control Policies can only be applied to accounts or OUs, not to resources directly; but they can deny the bucket creation/modification actions.

Answer

Enable CloudTrail to log all S3 API calls and set up a CloudWatch Events rule to notify the security team.

Answer

Use AWS Identity and Access Management (IAM) policies to deny access to S3 buckets that do not have encryption enabled.

Answer

Use AWS Config rules to detect non-compliant buckets and trigger a Lambda function to remediate.

Question 12

A company uses Amazon CloudWatch Logs to store application logs. The security team requires that logs be encrypted at rest using a customer-managed AWS KMS key. The team has enabled encryption on the CloudWatch Logs log group using a KMS key. However, after enabling encryption, the application fails to write logs to the log group. The application uses an IAM role that has the following permissions: logs:CreateLogStream, logs:PutLogEvents, and logs:DescribeLogStreams. Which additional permission does the application need?

Accepted Answer

kms:Encrypt. Option A is correct because to write to an encrypted log group, the IAM role needs kms:Encrypt permission for the KMS key. Option B is incorrect because kms:Decrypt is for reading, not writing. Option C is incorrect because kms:GenerateDataKey is used for envelope encryption, but CloudWatch Logs encryption uses direct encryption. Option D is incorrect because kms:CreateGrant is used to grant access to a key, not to write logs.

Answer

kms:GenerateDataKey

Answer

kms:CreateGrant

Answer

kms:Decrypt

Question 13

A company is using AWS CloudTrail to log API activity. The security team needs to ensure that any attempt to disable CloudTrail logging is immediately detected and alerted. What is the MOST secure and efficient way to achieve this?

Accepted Answer

Create an Amazon CloudWatch Events rule that matches the UpdateTrail API call and triggers an SNS notification.. Option C is correct because a CloudWatch Events rule can capture the UpdateTrail API call and trigger an SNS notification for immediate alerting. Option A is wrong because Config rules evaluate resource configurations but do not provide real-time notifications. Option B is wrong because GuardDuty focuses on threat detection, not configuration changes. Option D is wrong because Trusted Advisor provides best-practice checks but not real-time alerts.

Answer

Use AWS Trusted Advisor to check CloudTrail configuration and email the security team.

Answer

Enable Amazon GuardDuty and configure a custom threat list to monitor CloudTrail API calls.

Answer

Create an AWS Config rule to detect changes to CloudTrail configuration and send an SNS notification.

Question 14

A DevOps engineer is designing a CI/CD pipeline that deploys code to an EC2 instance. The engineer needs to securely store and retrieve database credentials used by the application. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager is designed to securely store and rotate secrets like database credentials. Option A is wrong because Systems Manager Parameter Store can store secrets but lacks automatic rotation. Option C is wrong because KMS is for encryption keys, not secret storage. Option D is wrong because S3 is not designed for secret management.

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Question 15

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB). The security team wants to block traffic from known malicious IP addresses before it reaches the ALB. What is the MOST effective approach?

Accepted Answer

Use AWS WAF with an IP set rule to block the malicious IP addresses.. Option D is correct because AWS WAF integrated with ALB can block malicious IPs at the application layer. Option A is wrong because security groups are stateful and can only allow/deny by IP/CIDR, but managing large lists is cumbersome. Option B is wrong because NACLs are stateless and not suitable for fine-grained IP blocking at the application layer. Option C is wrong because Network Firewall is for VPC-level inspection, not specifically for ALB.

Answer

Configure network ACLs on the ALB's subnet to block the malicious IPs.

Answer

Use AWS Network Firewall to inspect and block traffic at the VPC level.

Answer

Configure security groups to deny inbound traffic from the malicious IP addresses.