DOP-C02 Security and Compliance Practice Test 10 — 15 Questions

Question 1

A company needs to ensure that an EC2 instance can only be launched using a specific Amazon Machine Image (AMI) that has been approved by the security team. Which TWO actions should be taken?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the AMI ID matches the approved AMI.. An IAM policy with a condition for ec2:ImageId can restrict which AMIs can be used. Option C is correct because an SCP in AWS Organizations can enforce this across accounts. Option A is wrong because tagging does not enforce AMI usage. Option D is wrong because AWS Config rules only detect non-compliance, not prevent. Option E is wrong because CloudTrail is for logging.

Answer

Tag the approved AMI and use resource-based policies to allow only tagged AMIs.

Answer

Create an AWS Config rule to check that EC2 instances are launched from the approved AMI.

Answer

Enable CloudTrail to log all EC2 RunInstances calls and alert on unapproved AMIs.

Question 2

A company uses AWS KMS to encrypt data at rest in S3. The security team wants to ensure that KMS keys are rotated automatically every year. Which THREE steps should be taken?

Accepted Answer

Create a CloudWatch Events rule to notify the security team before the rotation date.. Amazon CloudWatch Events can be configured to send a notification (e.g., via SNS or email) to the security team before the scheduled annual key rotation date, ensuring awareness of the rotation. Option B is incorrect because S3 bucket policies cannot enforce KMS key rotation; key rotation is a property of the KMS key itself. Option C is correct because enabling automatic key rotation on a symmetric KMS key causes AWS KMS to rotate the backing key annually, meeting the requirement for automated rotation. Option D is incorrect because there is no `kms:RotateKeyOnDemand` action; automatic rotation does not require a specific key policy action, and manual rotation uses `ScheduleKeyDeletion` or creating new keys. Option E is correct because creating a new KMS key each year and updating the application to use the new key is a valid manual approach to ensure annual key rotation, fulfilling the security team's requirement to rotate keys every year.

Answer

Configure an S3 bucket policy to enforce key rotation.

Answer

Ensure the key policy allows the kms:RotateKeyOnDemand action.

Question 3

A company wants to implement a least-privilege security model for its IAM users. Which TWO practices should be applied?

Accepted Answer

Use IAM policy conditions to restrict access based on IP address or time of day.. IAM policy conditions allow you to restrict access based on attributes like IP address (using the `aws:SourceIp` condition key) or time of day (using `aws:CurrentTime`). This enforces least-privilege by limiting when and from where actions can be performed, reducing the attack surface without over-provisioning permissions.

Answer

Use only resource-based policies to manage permissions.

Answer

Attach the AdministratorAccess managed policy to all IAM users.

Answer

Use the AWS account root user for daily administrative tasks.

Question 4

A DevOps engineer needs to securely store database credentials for an application running on Amazon ECS. Which AWS service should be used to manage the credentials and provide them to the ECS tasks?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (Option A) is the correct service for securely storing database credentials. It provides automatic rotation, fine-grained access control, and native integration with Amazon ECS via task roles, allowing containers to retrieve secrets at runtime. Option B (Amazon S3 with SSE) is wrong because S3 is a general-purpose object store; storing credentials in S3 requires manual encryption and access management, and it lacks native rotation. Option C (AWS Systems Manager) is a broad management service that includes features like Run Command and Patch Manager, but it is not specifically designed for secrets management. Option D (AWS Systems Manager Parameter Store) can store parameters and secrets, but it lacks automatic rotation and is less secure for credential management compared to Secrets Manager.

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager

Answer

AWS Systems Manager Parameter Store

Question 5

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS. Which approach should be used to ensure compliance?

Accepted Answer

Attach a service control policy (SCP) to all accounts that denies s3:PutBucketEncryption or s3:PutObject without encryption.. A service control policy (SCP) attached to all accounts in the organization can deny the s3:PutBucketEncryption and s3:PutObject actions without encryption, enforcing KMS encryption across all S3 buckets. Option B is incorrect because bucket policies are applied per-bucket and cannot be centrally enforced across all accounts. Option C is incorrect because IAM policies in the master account do not affect member accounts. Option D is incorrect because AWS Config rules are detective, not preventive; while they can trigger remediation, the question asks for an approach to ensure compliance, and SCP provides preventive enforcement.

Answer

Apply an S3 bucket policy on each account's buckets to deny unencrypted object uploads.

Answer

Create an IAM policy in the master account that denies S3:PutObject without encryption.

Answer

Use AWS Config rules to evaluate S3 bucket encryption and trigger a remediation action via AWS Systems Manager Automation.

Question 6

A developer needs to allow an EC2 instance to read from an S3 bucket. Which is the most secure way to grant this access?

Accepted Answer

Create an IAM role with an S3 read policy and attach it to the EC2 instance profile.. The most secure way to grant an EC2 instance access to an S3 bucket is to use an IAM role with an S3 read policy attached to the instance profile. This allows the instance to obtain temporary security credentials via the instance metadata service, avoiding hardcoded keys or exposing credentials. Option A is wrong because root credentials are overly privileged and should never be used for routine access. Option B is wrong because storing access keys in user data is insecure—keys can be exposed through instance metadata or logs. Option C is wrong because bucket policies based on public IP addresses are not secure; IPs can change and other instances could have the same IP, plus S3 bucket policies should not rely on IP addresses for authentication. Option D is the correct approach because it uses IAM roles, the best practice for granting permissions to AWS services.

Answer

Use the root user credentials of the AWS account.

Answer

Store AWS access keys in the instance's user data and use them in the application.

Answer

Create an S3 bucket policy that allows the EC2 instance's public IP address.

Question 7

A company is using AWS KMS to encrypt sensitive data stored in Amazon S3. The security team wants to ensure that the KMS keys cannot be deleted accidentally. What should be done?

Accepted Answer

Enable deletion protection on the KMS key.. To prevent accidental deletion of a KMS key, you should enable deletion protection on the key. This setting prevents the key from being deleted until the protection is removed. Disabling the key (option B) does not prevent deletion; it only prevents use. Enabling automatic key rotation (option C) manages cryptographic material but does not affect deletion. Backing up key material in AWS Secrets Manager (option D) does not prevent deletion of the key itself. Therefore, option A is correct.

Answer

Set the key state to disabled.

Answer

Enable automatic key rotation.

Answer

Create a backup of the key material in AWS Secrets Manager.

Question 8

A company is using AWS CloudTrail to log API calls across all accounts in AWS Organizations. The security team wants to ensure that CloudTrail logs are not tampered with and are available for forensic analysis. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation.. The correct answers are C (CloudTrail log file validation) and E (server-side encryption with AWS KMS). CloudTrail log file validation provides integrity verification by using a hash of the log file, ensuring logs have not been tampered with. Enabling SSE-KMS protects the log files at rest, adding a layer of security for forensic analysis. Option A (disable public access) is a good security practice but does not directly address tamper resistance or forensic readiness. Option B (MFA delete) adds protection against accidental deletion but is not specifically for log integrity. Option D (AWS Backup) is not supported by CloudTrail for backing up log files.

Answer

Disable public access to the S3 bucket using block public access settings.

Answer

Enable MFA delete on the S3 bucket.

Answer

Use AWS Backup to create backups of the CloudTrail S3 bucket.

Question 9

A company uses AWS CodeBuild to build and test code. The build process needs to access a private Amazon RDS database to run integration tests. What is the most secure way to provide database credentials to the build project?

Accepted Answer

Store the credentials in AWS Secrets Manager and grant the CodeBuild service role permission to retrieve them.. AWS Secrets Manager is the most secure option because it is designed specifically for storing and rotating secrets like database credentials. It integrates with AWS CodeBuild via IAM roles, allowing the build project to retrieve credentials securely without exposing them in code or configuration. Option B (Parameter Store) can also store secrets but does not natively support automatic rotation, making it less suitable for database credentials. Option A is insecure because environment variables can be exposed in logs or console output. Option D is less secure than Secrets Manager because it requires managing encryption keys and access policies manually, and does not provide automatic rotation.

Answer

Store the credentials as environment variables in the build project configuration.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter.

Answer

Store the credentials in an encrypted S3 bucket and download them during the build phase.

Question 10

A DevOps engineer needs to allow an AWS Lambda function to write logs to Amazon CloudWatch Logs. What should the engineer do?

Accepted Answer

Attach an IAM policy to the Lambda execution role that allows logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents.. Lambda functions assume an IAM role (execution role) that grants permissions. To write logs to CloudWatch Logs, the execution role must include a policy allowing logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Option A is incorrect because Lambda functions do not use instance profiles; they use execution roles. Option C is incorrect because access keys are not used for Lambda; the function assumes a role. Option D is incorrect because resource-based policies on CloudWatch log groups are typically used for cross-account access, not for the same account Lambda to CloudWatch.

Answer

Attach an IAM role to the Lambda function's instance profile.

Answer

Generate an access key for the Lambda function and configure the function to use it.

Answer

Create a resource-based policy on the CloudWatch Logs log group that allows the Lambda function to write.

Question 11

A company uses AWS CodePipeline to deploy applications. The pipeline must deploy to an Amazon ECS cluster. The security team requires that all deployment actions be logged and auditable. Which configuration should be used?

Accepted Answer

Enable AWS CloudTrail to record all API calls made by CodePipeline.. AWS CloudTrail records all API calls made by CodePipeline, including deployment actions, providing an auditable log. Option A is incorrect because VPC Flow Logs log network traffic, not deployment actions. Option B is incorrect because S3 server access logs log requests to the artifact bucket, not the pipeline actions themselves. Option D is incorrect because CloudWatch Logs collects application logs, not API calls made by CodePipeline.

Answer

Enable VPC Flow Logs for the ECS cluster's VPC.

Answer

Enable Amazon S3 server access logs for the artifact bucket used by CodePipeline.

Answer

Enable Amazon CloudWatch Logs for the CodePipeline.

Question 12

A DevOps engineer needs to rotate database credentials stored in AWS Secrets Manager automatically every 30 days. What is the simplest way to achieve this?

Accepted Answer

Enable automatic rotation in Secrets Manager with a rotation interval of 30 days.. AWS Secrets Manager provides built-in automatic rotation with customizable rotation intervals, making it the simplest solution. Option B is incorrect because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; you would need additional automation. Option C is incorrect because while you could use a CloudWatch Events rule to trigger a Lambda function to rotate the secret, this is more complex than using Secrets Manager's built-in rotation. Option D is incorrect because writing a custom Lambda function and scheduling it with CloudWatch Events is unnecessary when Secrets Manager offers direct built-in rotation.

Answer

Store the credentials in Systems Manager Parameter Store and use a scheduled automation to update them.

Answer

Create a CloudWatch Events rule that triggers a Lambda function to rotate the secret.

Answer

Write a custom Lambda function that rotates the secret and schedule it with CloudWatch Events.

Question 13

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to download an object from the S3 bucket 'example-bucket' from an IP address of 10.1.2.3. What will happen?

Accepted Answer

The request is allowed because the condition matches the IP address.. The IAM policy includes a condition that allows s3:GetObject only if the request originates from an IP address within the 10.0.0.0/8 range. The user's IP 10.1.2.3 falls within this range, so the condition is satisfied and the action is allowed. Option A is wrong because a Deny statement is not required; an explicit Allow with a condition is sufficient. Option B is wrong because the policy does explicitly allow the action when the condition is met. Option C is wrong because the bucket policy is not specified and the IAM policy already grants permission; the result does not depend on the bucket policy unless it explicitly denies, but no such policy is shown.

Answer

The request is denied because the policy does not include a Deny statement.

Answer

The request is denied because the policy does not explicitly allow the action.

Answer

The result depends on the bucket policy.

Question 14

Refer to the exhibit. An EC2 instance with the IAM role MyAppRole is running. An application on the instance tries to delete an object from the S3 bucket 'example-bucket'. What will happen?

Accepted Answer

The request is denied because the IAM role does not have the s3:DeleteObject permission.. The IAM role MyAppRole does not include the s3:DeleteObject permission, so the request to delete an object from the S3 bucket is denied. Option A is incorrect because the role does not have full access—it only has specific permissions. Option B is incorrect because the bucket policy does not override the IAM role; both policies must allow the action for it to be permitted. Option D is incorrect because s3:GetObject does not include the delete permission; they are separate actions.

Answer

The request is allowed because the instance has full access to the bucket.

Answer

The request is denied because the bucket policy overrides the IAM role.

Answer

The request is allowed because the role has s3:GetObject permission, which includes delete.

Question 15

Refer to the exhibit. A security engineer sees this CloudTrail event. What action did the user 'admin' perform?

Accepted Answer

Created a new KMS key.. The CloudTrail event 'CreateKey' indicates that a new KMS key was created. Option A is incorrect because encrypting data would generate a different event (e.g., 'Encrypt'). Option B is incorrect because rotating a key corresponds to 'RotateKey' or 'EnableKeyRotation' events. Option D is incorrect because deleting a key generates 'DeleteKey' or 'ScheduleKeyDeletion' events.

Answer

Encrypted data with a KMS key.

Answer

Rotated a KMS key.

Answer

Deleted a KMS key.