DOP-C02 Security and Compliance Practice Test 11 — 15 Questions

Question 1

A company wants to centralize IAM user management across multiple AWS accounts. The company currently uses individual IAM users in each account. What is the BEST practice for centralized access control?

Accepted Answer

Use AWS Organizations and AWS IAM Identity Center (AWS SSO) to manage users centrally.. Option B is correct because AWS Organizations with IAM Identity Center allows centralized user management and single sign-on. Option A is wrong because cross-account roles require individual user management. Option C is wrong because sharing IAM users across accounts is not supported. Option D is wrong because federation alone does not centralize user management.

Answer

Create the same IAM users in each account with identical permissions.

Answer

Create IAM roles in each account and allow cross-account access from a central account.

Answer

Use IAM federation with an external identity provider and assign permissions based on SAML attributes.

Question 2

A company has an S3 bucket with sensitive data. The security team requires that all data uploaded to the bucket be automatically encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). How can this be enforced?

Accepted Answer

Use an S3 bucket policy that denies PutObject requests without the x-amz-server-side-encryption header.. Option B is correct because S3 bucket policies can deny uploads that do not include the x-amz-server-side-encryption header. Option A is wrong because default encryption applies to objects without encryption headers, but doesn't enforce encryption. Option C is wrong because IAM policies can require encryption but bucket policies are more direct. Option D is wrong because CloudTrail logs actions but does not enforce encryption.

Answer

Enable default encryption on the S3 bucket with SSE-KMS.

Answer

Enable AWS CloudTrail to monitor uploads and alert on unencrypted objects.

Answer

Create an IAM policy that requires all S3 operations to use SSE-KMS.

Question 3

A DevOps team uses AWS CodePipeline to deploy a web application. The application stores user session data in an ElastiCache Redis cluster. The security team mandates that all data in transit between the application and Redis must be encrypted. What should the team do?

Accepted Answer

Enable encryption in transit on the ElastiCache Redis cluster and configure the application to use TLS.. Option D is correct because ElastiCache Redis supports encryption in transit using TLS, which must be enabled at cluster creation. Option A is wrong because VPC peering does not encrypt traffic. Option B is wrong because NACLs do not encrypt. Option C is wrong because the application must use TLS, but the cluster must also be configured to support it.

Answer

Use a network ACL to allow only encrypted traffic on the Redis port.

Answer

Modify the application to use TLS when connecting to Redis.

Answer

Place the application and Redis cluster in the same VPC and use VPC peering.

Question 4

A company is using AWS CodeBuild as part of its CI/CD pipeline. The build projects need to access a private Amazon ECR repository to pull Docker images. What is the MOST secure way to grant CodeBuild access to ECR?

Accepted Answer

Create a service role for CodeBuild with an IAM policy that grants ECR pull access.. Option A is correct because CodeBuild can assume an IAM role with ECR permissions, and the role is passed in the build project configuration. Option B is wrong because storing credentials is insecure. Option C is wrong because ECR authorization tokens can be used but require handling credentials. Option D is wrong because VPC endpoints do not grant access; IAM permissions are still needed.

Answer

Configure a VPC endpoint for ECR and allow CodeBuild to connect through it.

Answer

Store ECR credentials in AWS Systems Manager Parameter Store and retrieve them in the buildspec.

Answer

Use the AWS CLI to retrieve an ECR authorization token and pass it to Docker.

Question 5

A security engineer needs to audit who accessed a specific S3 object and from which IP address over the past 30 days. Which AWS service should be used?

Accepted Answer

Amazon S3 server access logs. Option D is correct because S3 server access logs provide detailed records of requests, including requester identity and IP address. Option A is wrong because CloudTrail records management events but not data events by default. Option B is wrong because CloudWatch Logs can store logs but not generate them. Option C is wrong because Config records resource configuration, not access.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 6

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all unused IAM users are automatically identified and removed after 90 days of inactivity. What is the MOST effective solution?

Accepted Answer

Use IAM Access Analyzer to generate findings for unused access and automate user removal with a Lambda function.. Option C is correct because IAM Access Analyzer can track unused access and generate findings, which can be used to automate user removal. Option A is wrong because IAM credential report is manual. Option B is wrong because Config can detect user creation but not inactivity. Option D is wrong because CloudTrail logs API calls but requires custom analysis.

Answer

Use the IAM credential report to review last activity dates and manually delete users.

Answer

Enable CloudTrail Insights to detect inactive users and send alerts.

Answer

Use an AWS Config rule to detect IAM users and trigger a Lambda function to delete them after 90 days.

Question 7

A company needs to ensure that an EC2 instance can only be launched using a specific Amazon Machine Image (AMI) that has been approved by the security team. Which TWO actions should be taken?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the AMI ID matches the approved AMI.. Option B is correct because an IAM policy with a condition for ec2:Owner or ec2:ImageId can restrict which AMIs can be used. Option C is correct because an SCP in AWS Organizations can enforce this across accounts. Option A is wrong because Config rules only detect non-compliance, not prevent. Option D is wrong because tagging does not enforce AMI usage. Option E is wrong because CloudTrail is for logging.

Answer

Tag the approved AMI and use resource-based policies to allow only tagged AMIs.

Answer

Create an AWS Config rule to check that EC2 instances are launched from the approved AMI.

Answer

Enable CloudTrail to log all EC2 RunInstances calls and alert on unapproved AMIs.

Question 8

A company uses AWS KMS to encrypt data at rest in S3. The security team wants to ensure that KMS keys are rotated automatically every year. Which THREE steps should be taken?

Accepted Answer

Create a CloudWatch Events rule to notify the security team before the rotation date.. Option A is correct because automatic key rotation is enabled in KMS for symmetric keys. Option B is correct because key rotation rotates the backing key while keeping the same key ID. Option C is correct because a CloudWatch Events rule can notify before rotation. Option D is wrong because manual rotation creates a new key, which is not automatic. Option E is wrong because S3 bucket policy does not manage key rotation.

Answer

Configure an S3 bucket policy to enforce key rotation.

Answer

Ensure the key policy allows the kms:RotateKeyOnDemand action.

Answer

Create a new KMS key every year and update the application to use the new key.

Question 9

A company wants to implement a least-privilege security model for its IAM users. Which TWO practices should be applied?

Accepted Answer

Use IAM policy conditions to restrict access based on IP address or time of day.. Option A is correct because granting only required permissions is the principle of least privilege. Option B is correct because using conditions can further restrict permissions. Option C is wrong because using root user is not secure. Option D is wrong because resource-based policies are not always applicable. Option E is wrong because AdministratorAccess violates least privilege.

Answer

Use only resource-based policies to manage permissions.

Answer

Attach the AdministratorAccess managed policy to all IAM users.

Answer

Use the AWS account root user for daily administrative tasks.

Question 10

A company is deploying a web application on AWS and needs to ensure that all traffic to the application is encrypted in transit. The application runs behind an Application Load Balancer (ALB). Which configuration should be used to enforce HTTPS-only access?

Accepted Answer

Create an HTTPS listener on the ALB and configure a redirect rule from HTTP to HTTPS.. Option B is correct because the ALB can be configured with an HTTPS listener that redirects HTTP traffic to HTTPS, ensuring encrypted transit. Option A is wrong because security groups only control traffic at the instance level, not the ALB listener. Option C is wrong because CloudFront can enforce HTTPS but adds complexity and cost. Option D is wrong because modifying the application code is not a scalable or secure approach compared to ALB-level enforcement.

Answer

Configure the web server on the EC2 instances to only respond to HTTPS requests.

Answer

Configure the security group of the ALB to only allow inbound HTTPS traffic.

Answer

Use AWS CloudFront with a custom SSL certificate and set the viewer protocol policy to Redirect HTTP to HTTPS.

Question 11

A DevOps engineer needs to securely store database credentials for an application running on Amazon ECS. Which AWS service should be used to manage the credentials and provide them to the ECS tasks?

Accepted Answer

AWS Secrets Manager. Option C is correct because AWS Secrets Manager is designed to securely store and rotate secrets, and can be integrated with ECS via task roles. Option A is wrong because Parameter Store can store parameters but is not as focused on secrets management. Option B is wrong because Systems Manager is broader and not specifically for secrets. Option D is wrong because S3 is not secure for storing secrets without encryption and access control.

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager

Answer

AWS Systems Manager Parameter Store

Question 12

A company uses AWS Organizations to manage multiple accounts. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS. Which approach should be used to ensure compliance?

Accepted Answer

Attach a service control policy (SCP) to all accounts that denies s3:PutBucketEncryption or s3:PutObject without encryption.. Option D is correct because a service control policy (SCP) can deny actions that create or modify S3 buckets without encryption. Option A is wrong because Config rules only detect non-compliance, they don't enforce. Option B is wrong because bucket policies are per-bucket and cannot be applied globally. Option C is wrong because an IAM policy in the master account does not affect member accounts.

Answer

Apply an S3 bucket policy on each account's buckets to deny unencrypted object uploads.

Answer

Create an IAM policy in the master account that denies S3:PutObject without encryption.

Answer

Use AWS Config rules to evaluate S3 bucket encryption and trigger a remediation action via AWS Systems Manager Automation.

Question 13

A developer needs to allow an EC2 instance to read from an S3 bucket. Which is the most secure way to grant this access?

Accepted Answer

Create an IAM role with an S3 read policy and attach it to the EC2 instance profile.. Option A is correct because an IAM role attached to the EC2 instance allows temporary credentials without hardcoding keys. Option B is wrong because storing keys in the instance is insecure. Option C is wrong because root credentials are highly privileged and should never be used. Option D is wrong because resource-based policies on S3 can grant access to IAM roles, but the role must still be attached to the instance.

Answer

Use the root user credentials of the AWS account.

Answer

Store AWS access keys in the instance's user data and use them in the application.

Answer

Create an S3 bucket policy that allows the EC2 instance's public IP address.

Question 14

A company is using AWS KMS to encrypt sensitive data stored in Amazon S3. The security team wants to ensure that the KMS keys cannot be deleted accidentally. What should be done?

Accepted Answer

Enable deletion protection on the KMS key.. Option B is correct because enabling key rotation does not prevent deletion. Option C is correct because a backup of the key material does not prevent deletion. Option D is correct because disabling keys does not prevent deletion. The correct approach is to enable deletion protection on the KMS key.

Answer

Set the key state to disabled.

Answer

Enable automatic key rotation.

Answer

Create a backup of the key material in AWS Secrets Manager.

Question 15

A company is using AWS CloudTrail to log API calls across all accounts in AWS Organizations. The security team wants to ensure that CloudTrail logs are not tampered with and are available for forensic analysis. Which combination of actions should be taken? (Choose TWO.)

Accepted Answer

Enable CloudTrail log file validation.. Options A and C are correct. Option A enables log file validation, which provides integrity verification. Option C enables S3 server-side encryption to protect data at rest. Option B is wrong because CloudTrail does not support AWS Backup. Option D is wrong because disabling S3 public access is good but not sufficient. Option E is wrong because MFA delete adds protection but is not a CloudTrail feature.

Answer

Disable public access to the S3 bucket using block public access settings.

Answer

Enable MFA delete on the S3 bucket.

Answer

Use AWS Backup to create backups of the CloudTrail S3 bucket.