DOP-C02 Security and Compliance Practice Test 12 — 15 Questions

Question 1

An application running on EC2 needs to access an S3 bucket. To follow the principle of least privilege, what is the recommended approach?

Accepted Answer

Create an IAM role with a policy allowing only necessary S3 actions and attach it to the EC2 instance. The best practice is to create an IAM role with a policy that grants only the required S3 actions and attach the role to the EC2 instance. This avoids using long-term credentials. Access keys are long-term and insecure. Bucket policy can be used but is not the most secure for instance access. Security group is for network access, not API access.

Answer

Store AWS access keys in the application configuration

Answer

Use an S3 bucket policy to allow access from the EC2 instance's public IP

Answer

Configure the EC2 security group to allow outbound access to S3

Question 2

A company is using AWS CloudTrail to log API calls. The security team needs to ensure that log files are tamper-proof and can be used to verify integrity. Which feature should be enabled?

Accepted Answer

CloudTrail log file integrity validation. CloudTrail log file integrity validation uses SHA-256 hashing and digital signing to ensure logs have not been tampered with. S3 object lock prevents deletion but not modification. MFA delete protects deletion but not modification. SSE encrypts data at rest but does not protect integrity.

Answer

Server-side encryption (SSE-S3)

Answer

S3 Object Lock

Answer

MFA delete on the S3 bucket

Question 3

A DevOps engineer is troubleshooting a failed AWS CodeBuild project. The build fails with an error indicating that the IAM role does not have permission to describe Amazon ECR repositories. The role used by CodeBuild has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ecr:GetAuthorizationToken","ecr:BatchCheckLayerAvailability","ecr:GetDownloadUrlForLayer","ecr:BatchGetImage"],"Resource":"*"}]}. What is the missing permission?

Accepted Answer

ecr:DescribeRepositories. The error explicitly states the role lacks permission to 'describe Amazon ECR repositories,' which maps directly to the IAM action ecr:DescribeRepositories. This action is required by CodeBuild when it needs to verify the existence, URI, or configuration of an ECR repository before pulling an image. The existing policy only grants authentication and image-pull permissions (GetAuthorizationToken, BatchCheckLayerAvailability, GetDownloadUrlForLayer, BatchGetImage), none of which cover repository-level metadata inspection.

Answer

ecr:InitiateLayerUpload

Answer

ecr:GetRepositoryPolicy

Answer

ecr:ListImages

Question 4

A company wants to automatically detect and respond to suspicious activity in their AWS account. Which service should be used to generate alerts based on threat intelligence?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts for malicious activity using machine learning, anomaly detection, and integrated threat intelligence feeds. It analyzes CloudTrail management events, VPC Flow Logs, and DNS logs to generate findings and can trigger alerts via CloudWatch Events or Security Hub. This directly matches the requirement to detect and respond to suspicious activity based on threat intelligence.

Answer

AWS Config

Answer

Amazon Inspector

Answer

Amazon CloudWatch

Question 5

A company needs to audit all changes to IAM policies in their AWS account. Which services can be used to track and log these changes? (Select TWO.)

Accepted Answer

AWS Config. AWS CloudTrail logs API calls, including IAM policy changes. AWS Config can track configuration changes to IAM resources. CloudWatch Logs stores logs but does not track changes itself. GuardDuty is for threat detection. S3 is storage.

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Answer

Amazon GuardDuty

Question 6

A DevOps engineer created the IAM policy shown in the exhibit and attached it to a user. The user tries to upload an object to my-bucket without specifying the ACL. Why does the upload fail?

Accepted Answer

The policy condition requires the ACL to be bucket-owner-full-control, but the user did not specify it. The policy condition requires the ACL to be 'bucket-owner-full-control'. If the user does not specify an ACL, the default is usually 'private', which does not satisfy the condition. Therefore the action is denied. The resource ARN is correct. The action is allowed. The condition specifies StringEquals, which is correct for comparison.

Answer

The Effect should be Deny for this policy to work

Answer

The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket

Answer

The user does not have permission to list the bucket

Question 7

A DevOps engineer executed the CLI command shown in the exhibit. After creation, the security team requires that the log files be encrypted with a KMS key that is rotated every 90 days. The current key is a customer managed key with automatic rotation enabled set to 365 days. What should the engineer do to meet the requirement?

Accepted Answer

Create a new KMS key with automatic rotation set to 90 days and update the trail with the new key. The requirement is to encrypt log files with a KMS key that rotates every 90 days. The current key rotates every 365 days, and you cannot change the rotation period of an existing customer managed key; you must create a new key with the desired rotation period. Once created, you update the CloudTrail trail to use the new key by specifying the --kms-key-id parameter. Option D correctly describes this process. Option A is wrong because you cannot change the rotation period of an existing key. Option B is wrong because manually rotating a key does not meet the automatic rotation requirement and is not recommended. Option C is wrong because you cannot modify the rotation period of an existing key.

Answer

Use the existing key and change the rotation period in KMS

Answer

Disable automatic rotation and manually rotate the key every 90 days

Answer

Modify the KMS key to set the rotation period to 90 days

Question 8

Refer to the exhibit. This S3 bucket policy allows the root user of account 111122223333 to perform which actions?

Accepted Answer

Read and write objects in the bucket. The S3 bucket policy grants the root user of account 111122223333 permissions for s3:GetObject and s3:PutObject on the bucket's objects, which correspond to reading and writing objects. The policy does not include s3:DeleteObject, s3:ListBucket, or s3:PutBucketPolicy, so those actions are not allowed. Therefore, the root user can read and write objects in the bucket.

Answer

Change the bucket policy

Answer

Delete objects from the bucket

Answer

List objects in the bucket

Question 9

A company has a security policy requiring that all IAM users use multi-factor authentication (MFA) to access the AWS Management Console. The DevOps engineer needs to enforce this policy. What is the simplest way to achieve this?

Accepted Answer

Create an IAM policy that denies all actions unless MFA is present, and attach it to all IAM users or groups.. The simplest enforcement is an IAM policy that denies all actions unless the request is made with MFA, attached to users or groups. This uses the aws:MultiFactorAuthPresent condition key in a Deny statement, which blocks console and API access for users who have not authenticated with MFA. It is a native IAM mechanism requiring no additional services.

Answer

Use Amazon Cognito to require MFA for console access.

Answer

Enable MFA delete on the root account.

Answer

Enable MFA on the S3 bucket policy.

Question 10

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no member account can disable AWS CloudTrail or delete CloudTrail logs. What is the most effective way to enforce this control?

Accepted Answer

Apply a Service Control Policy that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging.. A Service Control Policy (SCP) applied at the organization or OU level is the most effective way to prevent member accounts from disabling CloudTrail or deleting logs because SCPs are enforced by AWS Organizations and cannot be overridden by account-level IAM policies, including root user actions. Denying cloudtrail:DeleteTrail and cloudtrail:StopLogging at the SCP level creates a hard guardrail across all accounts in scope. This is the canonical AWS Organizations security control pattern.

Answer

Require all accounts to use the same CloudTrail trail.

Answer

Create an IAM policy in each account that denies cloudtrail:DeleteTrail.

Answer

Configure CloudTrail to log to an S3 bucket in a centralized logging account and deny access to the bucket from member accounts.

Question 11

A DevOps engineer is designing an AWS Lambda function that needs to read secrets from AWS Secrets Manager. What is the most secure way to provide the Lambda function access to the secret?

Accepted Answer

Assign an IAM execution role to the Lambda function with a policy that allows secretsmanager:GetSecretValue on the specific secret.. The most secure approach is to give the Lambda function an IAM execution role whose policy grants secretsmanager:GetSecretValue scoped to the specific secret's ARN. Lambda assumes this role at runtime, so no credentials are stored in code or configuration, and the secret value is retrieved dynamically, allowing rotation without redeployment. This follows least privilege and avoids hardcoding secrets.

Answer

Store the secret in AWS Systems Manager Parameter Store and grant the Lambda function access to the parameter.

Answer

Encrypt the secret using AWS KMS and pass the encrypted value as an environment variable.

Answer

Store the secret in an environment variable in the Lambda function.

Question 12

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that any changes to IAM roles must be reviewed and approved by a security engineer before deployment. The DevOps engineer needs to implement a gating mechanism. Which approach should the engineer use?

Accepted Answer

Create a CodePipeline that deploys CloudFormation stacks and include a manual approval step for changes that modify IAM resources.. AWS CodePipeline can include a manual approval step before deploying CloudFormation stacks, allowing the security engineer to review and approve any changes to IAM roles. Option A is incorrect because AWS Config only detects changes after they occur; it cannot prevent deployment. Option B is incorrect because a service control policy would deny all IAM role creation across the organization, which is too restrictive and not a gating mechanism. Option C is incorrect because requiring MFA for CloudFormation actions does not specifically gate changes to IAM resources.

Answer

Use AWS Config to detect changes to IAM roles and trigger a Lambda function that reverts the change.

Answer

Apply a service control policy that denies iam:CreateRole and iam:UpdateAssumeRolePolicy across the organization.

Answer

Add a condition to the IAM policy that requires MFA for any CloudFormation action.

Question 13

A company is using Amazon S3 to store sensitive data. The security team mandates that all data must be encrypted at rest using server-side encryption with AWS Key Management Service (SSE-KMS). The DevOps engineer must ensure that any new objects uploaded to the bucket are automatically encrypted. What should the engineer do?

Accepted Answer

Enable default encryption on the S3 bucket and select AWS-KMS as the encryption method.. Enabling default encryption on the S3 bucket with SSE-KMS ensures that all objects uploaded to the bucket are automatically encrypted at rest with AWS KMS. Option A is incorrect because CORS is for cross-origin requests and does not affect encryption. Option B is incorrect because while a bucket policy can enforce encryption headers, it does not provide default encryption; it only denies requests without the header, and default encryption is a simpler and more reliable method. Option D is incorrect because versioning does not encrypt data.

Answer

Enable CORS on the bucket to allow encrypted uploads.

Answer

Apply a bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header with aws:kms.

Answer

Enable S3 Versioning to protect encrypted objects.

Question 14

A company is using AWS Lambda to process sensitive data. The security team requires that the Lambda function only be invoked from within a specific VPC and that the function's environment variables be encrypted at rest. Which TWO actions should the DevOps engineer take to meet these requirements?

Accepted Answer

Enable AWS KMS encryption for the Lambda function's environment variables using a customer-managed key.. Using a customer-managed KMS key to encrypt the Lambda function's environment variables satisfies the encryption at rest requirement. Option C is correct because configuring the Lambda function to be VPC-enabled and setting up a VPC endpoint for Lambda restricts invocation to within the specific VPC. Option B is incorrect because encrypting CloudWatch Logs does not encrypt the Lambda environment variables. Option D is incorrect because assigning an IAM execution role with KMS permissions is necessary but not sufficient; the encryption is enabled by configuring KMS on the function. Option E is incorrect because resource-based policies cannot restrict invocation to VPC origin alone; VPC configuration and endpoints are required.

Answer

Enable encryption for CloudWatch Logs using a KMS key.

Answer

Assign an IAM execution role with permissions to access a KMS key.

Answer

Attach a resource-based policy to the Lambda function that denies invoke unless the request comes from the VPC.

Question 15

A company is using AWS Secrets Manager to rotate database credentials automatically. The DevOps engineer needs to ensure that the rotation process is secure and does not cause downtime. Which THREE steps should the engineer take?

Accepted Answer

Set up CloudWatch alarms to monitor rotation failures.. Option B is correct because CloudWatch alarms on the rotation Lambda's errors, invocation failures, and Secrets Manager rotation metrics let the engineer detect and respond to failed rotations before credentials become stale and cause authentication outages. Option C is correct because the rotation Lambda must authenticate to the database using a dedicated rotation user whose credentials are stored in the secret, and that user needs privileges to modify the password of the target user (for example ALTER USER ... IDENTIFIED BY) so the application user's credentials can be changed without manual intervention. Option E is correct because the Lambda rotation function needs IAM permissions for secretsmanager:GetSecretValue, PutSecretValue, UpdateSecretVersionStage, and DescribeSecret so it can read the current secret, write the new version, and move the AWSCURRENT staging label to complete rotation. Option A is not needed because Secrets Manager automatically deprecates and removes old versions via staging labels; disabling rotation on an old version is not a valid or necessary step. Option D is not required because a VPC endpoint is only needed when the Lambda runs in a private VPC without NAT/internet access; it is an optional network-hardening measure, not one of the three required steps for secure, zero-downtime rotation.

Answer

Disable automatic rotation for the old secret version.

Answer

Configure the Lambda rotation function to use a VPC endpoint for Secrets Manager.