DOP-C02 Security and Compliance Practice Test 12 — 15 Questions

Question 1

A company uses AWS CodeBuild for CI/CD. The build project needs to access a private S3 bucket to download artifacts. What is the MOST secure way to grant access?

Accepted Answer

Create an IAM role with read access to the bucket and attach it to the CodeBuild project.. Using an IAM role with a trust policy for CodeBuild is the most secure method because it avoids long-term credentials. Option B is correct. Option A is wrong because embedding access keys in the buildspec.yml file is insecure and exposes credentials. Option C is wrong because granting public read access to the S3 bucket would allow anyone to access the artifacts. Option D is wrong because storing access keys in environment variables is less secure than using an IAM role, as environment variables can be exposed.

Answer

Embed the access keys in the buildspec.yml file.

Answer

Use an S3 bucket policy that grants public read access.

Answer

Store AWS access keys in CodeBuild environment variables.

Question 2

An organization has a compliance requirement to automatically detect and alert on any IAM user creation in all AWS accounts. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail captures all IAM user creation events as `CreateUser` API calls. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a rule that matches this specific event pattern and triggers an alert via Amazon SNS. This combination provides real-time detection and notification without custom code.

Answer

Amazon GuardDuty and Amazon SNS

Answer

Amazon S3 server access logs and Amazon Athena

Answer

AWS Config and AWS Lambda

Question 3

A company's security team suspects that an attacker has compromised an IAM user's access keys. The keys were used to launch instances in an unauthorized region. What is the FASTEST way to mitigate the threat?

Accepted Answer

Rotate the access keys immediately.. Rotating the access keys immediately invalidates the compromised keys, preventing further unauthorized use without disrupting the IAM user's other permissions or requiring a full user recreation. This is the fastest mitigation because it directly revokes the attacker's access while allowing the legitimate user to continue using new keys after rotation.

Answer

Delete the IAM user.

Answer

Change the IAM user's password.

Answer

Attach an AWS WAF to block the attacker's IP address.

Question 4

A developer needs to give a Lambda function read-only access to a DynamoDB table. What is the BEST practice to grant this permission?

Accepted Answer

Create an IAM role with a policy that allows DynamoDB read actions, and attach the role to the Lambda function.. Creating an IAM role with a policy that allows DynamoDB read actions and attaching it to the Lambda function is the best practice. Option B is correct because it follows the principle of least privilege and uses IAM roles designed for Lambda execution. Option A is incorrect because attaching policies directly to Lambda functions is not supported; Lambda uses execution roles. Option C is incorrect because storing AWS access keys in environment variables is insecure and violates best practices. Option D is incorrect because although DynamoDB supports resource-based policies, they are typically used for cross-account access; for same-account Lambda access, using an execution role is the standard approach.

Answer

Attach the policy directly to the Lambda function's configuration.

Answer

Store the AWS access keys in environment variables of the Lambda function.

Answer

Use a DynamoDB resource-based policy that grants access to the Lambda function's ARN.

Question 5

A company's security policy requires that all data stored in Amazon S3 must be encrypted at rest using server-side encryption with customer-managed keys (SSE-KMS). When uploading an object via the AWS CLI, which parameter must be included to enforce this?

Accepted Answer

--server-side-encryption aws:kms. The correct parameter to enforce server-side encryption with AWS KMS (SSE-KMS) when uploading an object via the AWS CLI is --server-side-encryption aws:kms, which corresponds to option D. Option A is incorrect because --kms-key-id only specifies the key ID but does not enable encryption by itself; it must be combined with --server-side-encryption aws:kms. Option B is incorrect because --sse AES256 is not a valid AWS CLI parameter; the correct parameter for SSE-S3 is --server-side-encryption AES256. Option C is incorrect because --encryption is not a valid AWS CLI parameter for server-side encryption.

Answer

--kms-key-id <key-id>

Answer

--sse AES256

Answer

--encryption aws:kms

Question 6

A company is using AWS CodePipeline with an S3 source action. The pipeline must be triggered only when a new object is uploaded to a specific prefix, and the pipeline should not have access to objects outside that prefix. Which configuration meets these requirements?

Accepted Answer

Configure the S3 source action with a CloudWatch event that has a prefix filter, and attach an IAM policy to the pipeline role that allows only the specific prefix.. Meets both requirements: a CloudWatch Events rule with a prefix filter ensures the pipeline is triggered only when an object is uploaded to the specific prefix, and an IAM policy attached to the pipeline role restricts its S3 access to only that prefix, preventing access to objects outside the prefix. Option A is incorrect because a Lambda function triggered by S3 events could be used, but the requirement is to use the S3 source action directly; additionally, a single S3 event without prefix filter would trigger on all objects. Option B is incorrect because a bucket policy that only allows a specific key can enforce access restrictions, but it does not control the trigger—the S3 source action would still need to be configured with a specific object key, and the pipeline would not be triggered automatically on new uploads. Option D is incorrect because using a separate bucket does not inherently restrict access or trigger behavior; it would require additional configuration.

Answer

Use an S3 event notification to trigger a Lambda function that starts the pipeline.

Answer

Configure the S3 source action with a specific object key and use a bucket policy to allow only that key.

Answer

Use a separate S3 bucket for the pipeline's source artifacts.

Question 7

Which TWO actions are effective ways to protect an AWS account root user? (Choose 2)

Accepted Answer

Enable multi-factor authentication (MFA) on the root user.. The correct actions to protect the root user are enabling MFA (Option C) and disabling or deleting any access keys associated with the root user (Option E). Option A is incorrect because a strong password alone is insufficient; MFA is essential. Option B is wrong because the root user should not be used for everyday tasks—it should be reserved for limited administrative actions. Option D is incorrect because rotating the password every 30 days does not address the core security risk; the root user should not have access keys at all.

Answer

Use a strong, complex password and change it every 90 days.

Answer

Use the root user for everyday administrative tasks.

Answer

Rotate the root user password every 30 days.

Question 8

Which THREE are features of AWS Key Management Service (KMS) that help with compliance requirements? (Choose 3)

Accepted Answer

Automatic key rotation every year (optional).. AWS KMS supports optional automatic annual key rotation for customer managed keys. This helps meet compliance frameworks (e.g., PCI DSS, SOC, HIPAA) that require periodic cryptographic key rotation to limit the amount of data encrypted under a single key. When enabled, KMS automatically rotates the key material once per year, creating a new backing key while retaining the old one for decryption of previously encrypted data.

Answer

Automatic password generation for databases.

Answer

Automatic deletion of keys after a specified period.

Question 9

An IAM policy is attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' even though they are connecting from within the 10.0.0.0/16 IP range. What is the MOST likely reason?

Accepted Answer

The user is accessing S3 through a VPC endpoint, but the condition only works for public IP addresses.. The condition 'aws:SourceIp' evaluates the IP address of the requester. However, if the user is accessing S3 through a VPC endpoint, the source IP is a private IP from the VPC, but the condition works only for public IP addresses. Option C is correct. Option A is wrong because the policy allows GetObject. Option B is wrong because the resource is correct. Option D is wrong because the condition is for source IP, not VPC endpoint.

Answer

The policy needs an additional condition for VPC endpoint.

Answer

The policy does not allow the s3:ListBucket action.

Answer

The resource ARN is missing the bucket-level permission.

Question 10

A key policy for a KMS customer managed key includes the above statement. An IAM role 'AdminRole' in account 123456789012 is allowed to decrypt. However, when the role attempts to decrypt data, it receives an access denied error. What is the MOST likely cause?

Accepted Answer

The condition 'kms:GrantIsForAWSResource' is preventing direct API calls.. The condition 'kms:GrantIsForAWSResource' restricts the permission to requests that come from AWS services that integrate with KMS (e.g., S3, Lambda) rather than direct API calls from the role. As a result, when the IAM role 'AdminRole' attempts to call kms:Decrypt directly, it receives an access denied error. Option C is correct. Option A is incorrect because 'kms:Decrypt' is the correct action; wildcards are not needed. Option B is incorrect because the resource can be '*' in a key policy since the policy is attached to the key itself, scoping it automatically. Option D is incorrect because the principal ARN is correctly specified as the IAM role in the account.

Answer

The action should be 'kms:Decrypt*'.

Answer

The resource should be the key ARN, not '*'.

Answer

The principal ARN is incorrect.

Question 11

A security engineer runs the above CLI command to investigate IAM user 'Bob'. The output shows Bob logged in and then created a new IAM user. Which additional information should the engineer look for to determine if this was a security incident?

Accepted Answer

The source IP address from the CloudTrail event details.. To determine if the activity is malicious, the engineer should check the source IP address from the CloudTrail event details. The source IP can indicate if the login came from an unexpected location, suggesting compromised credentials. Option A is wrong because the event name (CreateUser) is already known from the command output. Option B is wrong because the time the new user was last modified does not provide direct evidence about the unauthorized nature of the login event. Option D is wrong because the IAM group memberships of the new user do not indicate whether the login itself was unauthorized.

Answer

The event name for the user creation.

Answer

The time the new user was last modified.

Answer

The IAM group memberships of the new user.

Question 12

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM user or role in any account can create or modify VPCs. Which SCP should be applied to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}. It denies both the ec2:CreateVpc and ec2:ModifyVpc actions, which covers all operations that could create or modify VPCs. A service control policy (SCP) with a Deny effect overrides any Allow permissions, ensuring that no IAM user or role in any account under the root OU can perform these actions, even if attached IAM policies grant them.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifyVpc","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateVpc","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}

Question 13

A DevOps engineer is configuring AWS CloudTrail to log all management events across all regions. The engineer wants to ensure that log files are encrypted at rest using a customer-managed KMS key. What is the correct way to achieve this?

Accepted Answer

Specify a KMS key ID in the CloudTrail trail configuration and grant CloudTrail permissions to use the key.. AWS CloudTrail supports encryption at rest using a customer-managed AWS KMS key (SSE-KMS). To achieve this, you must specify the KMS key ID in the CloudTrail trail configuration and grant CloudTrail permissions to use that key via the key policy. Option A is wrong because CloudTrail does not support SSE-C (customer-provided keys); it only supports SSE-S3 or SSE-KMS. Option B is wrong because client-side encryption is not a built-in CloudTrail feature and would require custom implementation. Option C is wrong because SSE-S3 uses S3-managed keys, not a customer-managed KMS key. Therefore, D is the only correct way to encrypt CloudTrail logs with a customer-managed KMS key.

Answer

Use SSE-C with a customer-provided key when uploading logs to S3.

Answer

Enable client-side encryption before delivering logs to S3.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Question 14

A company uses AWS CodePipeline to deploy a web application to an Auto Scaling group. The security team requires that all artifacts in the pipeline be encrypted at rest. The pipeline uses an S3 bucket as the artifact store. Which combination of actions should the DevOps engineer take to meet this requirement with minimal operational overhead?

Accepted Answer

Enable S3 default encryption with SSE-S3 on the artifact bucket.. Enabling S3 default encryption with SSE-S3 on the artifact bucket is the simplest way to encrypt all objects at rest with minimal operational overhead. SSES3 uses S3-managed keys, requiring no additional key management or permissions. Option A is wrong because AWS Certificate Manager provides TLS certificates, not encryption for S3 objects. Option C is wrong because using a Lambda function to encrypt artifacts after each stage adds unnecessary complexity and does not automatically encrypt all artifacts, especially existing ones. Option D is wrong because creating a customer-managed KMS key introduces additional overhead for key management and permissions, which is not minimal.

Answer

Use AWS Certificate Manager to encrypt the artifacts.

Answer

Use an AWS Lambda function to encrypt artifacts after each pipeline stage.

Answer

Create a customer-managed KMS key and configure the pipeline to use it for artifact encryption.

Question 15

An organization uses AWS Key Management Service (KMS) with customer-managed keys. The security policy requires automatic key rotation every year. A DevOps engineer notices that the key material is not rotating as expected. What is the most likely cause?

Accepted Answer

The key was created by importing key material; automatic rotation is not supported for imported keys.. Automatic key rotation is not supported for imported key material. Option B is wrong because KMS does not charge extra for automatic rotation. Option C is wrong because KMS does not require re-importing for rotation; it's simply not available. Option D is wrong because the key state does not prevent rotation.

Answer

The key must be re-imported annually to enable rotation.

Answer

The key is not enabled for rotation due to a billing limit.

Answer

The key is in a 'Pending Deletion' state and cannot be rotated.