DOP-C02 Security and Compliance Practice Test 11 — 15 Questions

Question 1

A company wants to automate patching of EC2 instances running Amazon Linux 2 while ensuring compliance with security policies. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates the patching of EC2 instances, including Amazon Linux 2, by using patch baselines to define approved patches and compliance rules. It integrates with maintenance windows and State Manager to schedule and enforce patching, ensuring instances remain compliant with security policies without manual intervention.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Config

Question 2

A DevOps engineer needs to enforce encryption in transit for all traffic between a fleet of EC2 instances and an Application Load Balancer (ALB). The ALB is configured with a TLS listener. Which step should the engineer take to ensure end-to-end encryption?

Accepted Answer

Configure the target group to use HTTPS protocol and install a certificate on each EC2 instance. To enforce end-to-end encryption between the ALB and EC2 instances, the target group must use HTTPS protocol. This requires each EC2 instance to have a TLS certificate installed so that traffic from the ALB to the instances is encrypted. Option A is incorrect because HTTP does not encrypt traffic. Option C is incorrect because security groups control network access but do not enforce encryption. Option D is incorrect because terminating TLS at the ALB and using HTTP to instances would leave the traffic between ALB and instances unencrypted.

Answer

Configure the target group to use HTTP protocol

Answer

Use security group rules to enforce encryption

Answer

Terminate TLS at the ALB and use HTTP to instances

Question 3

A company uses AWS Organizations with multiple accounts. The security team requires that all newly created S3 buckets in any account automatically have default encryption enabled and block public access. Which solution is MOST operationally efficient?

Accepted Answer

Apply a service control policy (SCP) that denies creation of buckets without encryption and public access block. The most operationally efficient solution is to use an SCP in AWS Organizations that denies creation of S3 buckets without default encryption and public access block. This enforces the security requirements at the organization level, preventing non-compliant bucket creation across all accounts without additional automation. Option A relies on CloudTrail and Lambda, which is reactive and adds complexity. Option C is manual and not scalable. Option D uses AWS Config to detect non-compliant buckets but requires additional remediation steps, making it less efficient than a preventive SCP.

Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to apply settings

Answer

Create a bucket policy on each existing bucket and rely on developers to apply it to new buckets

Answer

Use AWS Config rules to detect non-compliant buckets and send notifications

Question 4

A company is using AWS KMS to encrypt data at rest for S3 objects. The security team wants to rotate the KMS key annually. Which action should the team take to implement automatic key rotation?

Accepted Answer

Enable automatic key rotation when creating the KMS key. AWS KMS supports automatic annual key rotation for customer managed keys (CMKs) when enabled at creation or via the key's rotation configuration. Once enabled, KMS automatically rotates the key material every 365 days, creating a new backing key while retaining the old one for decryption of previously encrypted data. This satisfies the security team's requirement without manual intervention.

Answer

Create a new key manually each year and update the S3 bucket policy

Answer

Use AWS Certificate Manager (ACM) to rotate the KMS key

Answer

Use an AWS managed key, which rotates automatically every year

Question 5

A company uses AWS Secrets Manager to store database credentials. The security team needs to automatically rotate the secrets every 30 days. Which action should be taken?

Accepted Answer

Enable automatic rotation on the secret and configure the rotation interval to 30 days. AWS Secrets Manager supports automatic rotation of secrets using a Lambda function. You can enable automatic rotation on the secret and configure the rotation interval to 30 days (option A). Option B is not automatic, as it requires manual intervention each month. Option C is incorrect because AWS Systems Manager Parameter Store does not natively rotate secrets; implementing a scheduled Lambda is a custom solution, not a direct action. Option D is incorrect because AWS KMS rotates encryption keys, not the secret value itself.

Answer

Manually rotate the secret every 30 days using the AWS Management Console

Answer

Store the secret in AWS Systems Manager Parameter Store and use a scheduled Lambda to update it

Answer

Use AWS KMS to rotate the secret by re-encrypting with a new key

Question 6

A DevOps engineer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline deploys a critical application. Which security practice should the engineer implement to prevent unauthorized changes to the pipeline?

Accepted Answer

Attach an IAM policy that uses a condition to allow only specific users or roles to modify the pipeline. Using IAM policies with conditions allows only specific users or roles to modify the pipeline, thereby preventing unauthorized changes. Option A is incorrect because encrypting pipeline artifacts with KMS protects data at rest but does not prevent pipeline modifications. Option B is incorrect because SNS notifications alert about changes but do not prevent them. Option D is incorrect because enabling CloudTrail and CloudWatch Events detects and notifies about changes but does not prevent them.

Answer

Encrypt the pipeline artifacts using AWS KMS

Answer

Use SNS to send notifications when the pipeline is updated

Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to notify on pipeline changes

Question 7

A company is subject to regulatory compliance that requires all access to S3 buckets to be logged and monitored. The company has thousands of buckets. Which solution is MOST scalable and cost-effective?

Accepted Answer

Enable AWS CloudTrail with data events for S3 and send logs to CloudWatch Logs. AWS CloudTrail with data events for S3 provides centralized logging of all S3 API calls (e.g., GetObject, PutObject) across thousands of buckets without needing to enable logging per bucket. Logs can be sent to CloudWatch Logs for monitoring and alerting, and to S3 for long-term storage, offering a scalable and cost-effective solution. Option A is wrong because S3 server access logs must be enabled individually on each bucket and stored in a separate bucket, which is less scalable and adds complexity. Option C is wrong because VPC Flow Logs capture network-level traffic to S3 endpoints but do not log the actual S3 API operations. Option D is wrong because AWS Config rules can detect changes in bucket policies but do not log data access events like read/write operations.

Answer

Enable S3 server access logging on each bucket and aggregate logs into a central bucket

Answer

Use VPC Flow Logs to capture traffic to S3

Answer

Use AWS Config rules to track bucket access and publish to SNS

Question 8

Which TWO actions can help protect an AWS account's root user? (Choose TWO.)

Accepted Answer

Do not create access keys for the root user; use IAM users instead. Not creating access keys for the root user is a best practice because root access keys have full permissions and cannot be restricted. Option C is correct: enabling MFA adds an extra layer of security. Option B is wrong: the root user cannot be deleted. Option D is wrong: rotating the password alone does not protect against unauthorized access; MFA is more important. Option E is wrong: changing the email to a group email does not inherently protect the account and may cause issues with account recovery.

Answer

Delete the root user after creating administrative IAM users

Answer

Rotate the root user password every 30 days

Answer

Change the root user's email address to a group email

Question 9

Which THREE are components of the AWS Shared Responsibility Model? (Choose THREE.)

Accepted Answer

Customers are responsible for managing IAM users and permissions. In the AWS Shared Responsibility Model, AWS is responsible for the security of the cloud infrastructure (Option E), while customers are responsible for security in the cloud, including managing IAM users and permissions (Option B) and securing their data (Option D). Option A is incorrect because customers are responsible for patching their own applications on EC2, not AWS. Option C is incorrect because customers manage their own IAM roles, not AWS.

Answer

AWS is responsible for patching customer applications on EC2

Answer

AWS is responsible for managing customer IAM roles

Question 10

Refer to the exhibit. A DevOps engineer attaches the IAM policy to an IAM user. The user reports being unable to download objects from the S3 bucket. What is the likely cause?

Accepted Answer

The policy does not allow s3:ListBucket, which is required for the AWS CLI to list objects. The policy only allows s3:GetObject, but the user may be trying to list objects or access a bucket that requires additional permissions. Option A is wrong because the policy allows GetObject. Option B is wrong because the policy is not malformed. Option D is wrong because the user is allowed to access the bucket.

Answer

The bucket policy denies access to the user

Answer

The policy is malformed because the Resource element is incorrect

Answer

The user's access key is expired

Question 11

Refer to the exhibit. The command is run to investigate a potential security incident. The output shows no events. Which of the following is the MOST likely reason?

Accepted Answer

The CloudTrail trail is configured to log only data events. The output shows no events when looking up ConsoleLogin events. CloudTrail trails can be configured to log management events (like ConsoleLogin) and/or data events. By default, a trail logs management events. However, if the trail is configured to log only data events, management events are not recorded. Therefore, the most likely reason for no events is that the trail is set to log only data events, as stated in option B.

Answer

CloudTrail is not enabled to log management events in us-east-1

Answer

The event name is misspelled; it should be "Console Login"

Answer

The IAM user running the command does not have cloudtrail:LookupEvents permission

Question 12

Refer to the exhibit. The S3 bucket policy is applied to a bucket. An application attempts to upload an object to the bucket using HTTP (not HTTPS). What will happen?

Accepted Answer

The upload fails because the condition matches HTTP requests. The bucket policy includes an explicit deny for all S3 actions when aws:SecureTransport is false (i.e., HTTP). This deny overrides any allow policies, so the upload fails. Option A is correct because the condition matches HTTP requests. Option B is incorrect because the explicit deny overrides any allow. Option C is incorrect because the deny is explicit, so the condition is evaluated. Option D is incorrect because the policy only denies HTTP, not HTTPS.

Answer

The upload succeeds if the bucket also has an allow policy for the user

Answer

The upload succeeds because there is no explicit allow statement

Answer

The upload fails because the bucket policy does not allow any access

Question 13

A company uses AWS Organizations to manage multiple accounts. The security team wants to centrally enforce that S3 buckets in all accounts block public access. Which policy should be attached to the root organizational unit to achieve this?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit.. Service control policies (SCPs) attached to the root organizational unit can centrally deny actions across all member accounts. An SCP that denies `s3:PutBucketPublicAccessBlock` and related actions can enforce that S3 buckets block public access. Option D is correct. Option B is incorrect because AWS Config rules only detect noncompliant resources but cannot prevent the action; they are detective, not preventive. Options A and C are also incorrect as explained.

Answer

Configure a bucket policy on each S3 bucket to deny public access.

Answer

Create an AWS Config rule to mark noncompliant buckets.

Answer

Attach an IAM policy to the root user of each account.

Question 14

A DevOps engineer needs to store database credentials for an application running on Amazon ECS. The credentials must be automatically rotated every 30 days and encrypted at rest. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Store credentials in AWS Secrets Manager and configure automatic rotation.. AWS Secrets Manager provides built-in automatic rotation and encryption at rest using AWS KMS. Option D meets the requirements with the least operational overhead. Option A is incorrect because Parameter Store (SecureString) does not support automatic rotation natively. Option B requires custom rotation logic and management. Option C embeds credentials insecurely in environment variables without rotation.

Answer

Store credentials in AWS Systems Manager Parameter Store as SecureString.

Answer

Encrypt credentials with AWS KMS and store them in a versioned S3 bucket.

Answer

Embed credentials as environment variables in the ECS task definition.

Question 15

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet but must not be directly accessible from the internet. Which configuration allows this?

Accepted Answer

Deploy a NAT gateway in a public subnet and route the private subnet's traffic through it.. A NAT gateway deployed in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet. This matches the requirement for downloading patches without direct accessibility. Option B is correct. Option A is incorrect because a VPN connection provides access to an on-premises network, not general internet access. Option C is incorrect because a bastion host provides SSH/RDP access to instances, not outbound internet connectivity for patch downloads. Option D is incorrect because attaching an internet gateway and adding a route to the private subnet route table would make the instances directly accessible from the internet, violating the requirement.

Answer

Set up a VPN connection to the company's on-premises network and route traffic through it.

Answer

Deploy a bastion host in the public subnet and configure the instance to use it.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet route table.