DOP-C02 Security and Compliance Practice Test 12 — 15 Questions

Question 1

A company uses AWS CodeBuild to build and test code. The build process needs to access a private Amazon RDS database to run integration tests. What is the most secure way to provide database credentials to the build project?

Accepted Answer

Store the credentials in AWS Secrets Manager and grant the CodeBuild service role permission to retrieve them.. Option B is correct because AWS Secrets Manager provides secure storage and retrieval of secrets, and CodeBuild can access them using a service role. Option A is wrong because environment variables are visible in plain text. Option C is wrong because storing credentials in S3 is less secure and requires additional access. Option D is wrong because parameter store does not support automatic rotation.

Answer

Store the credentials as environment variables in the build project configuration.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter.

Answer

Store the credentials in an encrypted S3 bucket and download them during the build phase.

Question 2

A DevOps engineer needs to allow an AWS Lambda function to write logs to Amazon CloudWatch Logs. What should the engineer do?

Accepted Answer

Attach an IAM policy to the Lambda execution role that allows logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents.. Option A is correct because Lambda functions assume an IAM role (execution role) that grants permissions. Option B is wrong because Lambda functions do not use access keys. Option C is wrong because Lambda functions do not have instance profiles. Option D is wrong because resource-based policies are for cross-account access, not for Lambda to CloudWatch.

Answer

Attach an IAM role to the Lambda function's instance profile.

Answer

Generate an access key for the Lambda function and configure the function to use it.

Answer

Create a resource-based policy on the CloudWatch Logs log group that allows the Lambda function to write.

Question 3

A company uses AWS CodePipeline to deploy applications. The pipeline must deploy to an Amazon ECS cluster. The security team requires that all deployment actions be logged and auditable. Which configuration should be used?

Accepted Answer

Enable AWS CloudTrail to record all API calls made by CodePipeline.. Option B is correct because CloudTrail logs all API calls, including those from CodePipeline. Option A is wrong because VPC Flow Logs log network traffic, not deployment actions. Option C is wrong because CloudWatch Logs logs application logs, not API calls. Option D is wrong because S3 access logs log requests to S3, not pipeline actions.

Answer

Enable VPC Flow Logs for the ECS cluster's VPC.

Answer

Enable Amazon S3 server access logs for the artifact bucket used by CodePipeline.

Answer

Enable Amazon CloudWatch Logs for the CodePipeline.

Question 4

A security team wants to automatically detect and remediate S3 buckets that are publicly accessible across multiple AWS accounts. Which solution is MOST efficient and scalable? (Choose THREE.)

Accepted Answer

Apply a service control policy (SCP) to deny s3:PutBucketAcl that makes buckets public.. Options A, C, and E are correct. AWS Config can evaluate rules across accounts. SCPs can prevent public access. Centralized logging via CloudWatch Events enables automation. Option B is wrong because manual review is not scalable. Option D is wrong because Trusted Advisor is per-account and manual.

Answer

Use AWS Trusted Advisor to check for open S3 buckets and send alerts.

Answer

Manually review each account's S3 bucket permissions weekly.

Question 5

A company is using AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that the KMS key can only be used from within the company's VPC. What should be done? (Choose TWO.)

Accepted Answer

Modify the KMS key policy to include a condition that requires the kms:ViaService to be from the VPC endpoint.. Options B and C are correct. A VPC endpoint for KMS allows private connectivity. A key policy with a condition for the VPC endpoint restricts usage. Option A is wrong because SCPs cannot restrict KMS key usage. Option D is wrong because bucket policies cannot restrict KMS key usage. Option E is wrong because security groups do not apply to KMS.

Answer

Attach a security group to the KMS key.

Answer

Configure the S3 bucket policy to allow only requests from the VPC.

Answer

Create a service control policy (SCP) that denies KMS operations from outside the VPC.

Question 6

A DevOps engineer needs to rotate database credentials stored in AWS Secrets Manager automatically every 30 days. What is the simplest way to achieve this?

Accepted Answer

Enable automatic rotation in Secrets Manager with a rotation interval of 30 days.. Option A is correct because Secrets Manager has built-in automatic rotation with customizable rotation intervals. Option B is wrong because Lambda functions are used for custom rotation, not automatic. Option C is wrong because Parameter Store does not support automatic rotation. Option D is wrong because CloudWatch Events can trigger rotation but the simplest way is to use Secrets Manager's built-in feature.

Answer

Store the credentials in Systems Manager Parameter Store and use a scheduled automation to update them.

Answer

Create a CloudWatch Events rule that triggers a Lambda function to rotate the secret.

Answer

Write a custom Lambda function that rotates the secret and schedule it with CloudWatch Events.

Question 7

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to download an object from the S3 bucket 'example-bucket' from an IP address of 10.1.2.3. What will happen?

Accepted Answer

The request is allowed because the condition matches the IP address.. Option B is correct because the policy allows s3:GetObject only if the condition matches. The IP 10.1.2.3 falls within 10.0.0.0/8, so the condition is satisfied. Option A is wrong because the condition is met. Option C is wrong because the policy does not specify a Deny. Option D is wrong because the bucket policy is not shown.

Answer

The request is denied because the policy does not include a Deny statement.

Answer

The request is denied because the policy does not explicitly allow the action.

Answer

The result depends on the bucket policy.

Question 8

Refer to the exhibit. An EC2 instance with the IAM role MyAppRole is running. An application on the instance tries to delete an object from the S3 bucket 'example-bucket'. What will happen?

Accepted Answer

The request is denied because the IAM role does not have the s3:DeleteObject permission.. Option A is correct because the policy does not grant s3:DeleteObject permission. The request will be denied. Option B is wrong because the role does not have the required permission. Option C is wrong because the request will not be allowed. Option D is wrong because the error is different.

Answer

The request is allowed because the instance has full access to the bucket.

Answer

The request is denied because the bucket policy overrides the IAM role.

Answer

The request is allowed because the role has s3:GetObject permission, which includes delete.

Question 9

Refer to the exhibit. A security engineer sees this CloudTrail event. What action did the user 'admin' perform?

Accepted Answer

Created a new KMS key.. Option B is correct because the event is CreateKey, and the resource is a KMS key. Option A is wrong because the event is not a key deletion. Option C is wrong because the event is not an encryption operation. Option D is wrong because the event is not a key rotation.

Answer

Encrypted data with a KMS key.

Answer

Rotated a KMS key.

Answer

Deleted a KMS key.

Question 10

A company wants to automate patching of EC2 instances running Amazon Linux 2 while ensuring compliance with security policies. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is the service designed to automate patching across EC2 instances and on-premises servers. Option A is wrong because AWS Config is for compliance auditing, not patching. Option B is wrong because Amazon Inspector is for vulnerability assessment. Option D is wrong because AWS Trusted Advisor is for best practice checks.

Answer

AWS Trusted Advisor

Answer

Amazon Inspector

Answer

AWS Config

Question 11

A DevOps engineer needs to enforce encryption in transit for all traffic between a fleet of EC2 instances and an Application Load Balancer (ALB). The ALB is configured with a TLS listener. Which step should the engineer take to ensure end-to-end encryption?

Accepted Answer

Configure the target group to use HTTPS protocol and install a certificate on each EC2 instance. To enforce encryption in transit, the ALB target group should use HTTPS protocol, which requires the instances to present a certificate. Option A is wrong because HTTP does not encrypt traffic. Option B is wrong because the TLS termination should be at the ALB, not re-encrypted. Option D is wrong because security groups do not enforce encryption.

Answer

Configure the target group to use HTTP protocol

Answer

Use security group rules to enforce encryption

Answer

Terminate TLS at the ALB and use HTTP to instances

Question 12

A company uses AWS Organizations with multiple accounts. The security team requires that all newly created S3 buckets in any account automatically have default encryption enabled and block public access. Which solution is MOST operationally efficient?

Accepted Answer

Apply a service control policy (SCP) that denies creation of buckets without encryption and public access block. Using an SCP in AWS Organizations allows enforcing policies across all accounts. Option A is wrong because it only works at account level per bucket. Option B is wrong because CloudTrail only logs, it doesn't enforce. Option D is wrong because Config can detect but not automatically remediate without additional automation.

Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to apply settings

Answer

Create a bucket policy on each existing bucket and rely on developers to apply it to new buckets

Answer

Use AWS Config rules to detect non-compliant buckets and send notifications

Question 13

A company is using AWS KMS to encrypt data at rest for S3 objects. The security team wants to rotate the KMS key annually. Which action should the team take to implement automatic key rotation?

Accepted Answer

Enable automatic key rotation when creating the KMS key. AWS KMS supports automatic annual rotation for customer managed keys. Option A is wrong because automatic rotation is enabled at key creation. Option C is wrong because manual rotation is not automatic. Option D is wrong because you cannot rotate AWS managed keys.

Answer

Create a new key manually each year and update the S3 bucket policy

Answer

Use AWS Certificate Manager (ACM) to rotate the KMS key

Answer

Use an AWS managed key, which rotates automatically every year

Question 14

A DevOps team is deploying a web application on EC2 instances behind an ALB. The application must authenticate users using an external identity provider (IdP) that supports SAML 2.0. Which solution provides the simplest integration with the ALB?

Accepted Answer

Configure the ALB to use an SAML identity provider for authentication. ALB can authenticate users using SAML IdP. Option B is wrong because Cognito is for user pools, not direct SAML integration with ALB. Option C is wrong because CloudFront with Lambda@Edge adds complexity. Option D is wrong because the application itself would need to handle SAML, adding overhead.

Answer

Use Amazon Cognito user pools with SAML federation and integrate with ALB

Answer

Use AWS CloudFront with Lambda@Edge to validate SAML tokens

Answer

Install a SAML service provider library on each EC2 instance

Question 15

A company's security policy requires that all EC2 instances must be launched with an IAM role that provides least privilege access. A DevOps engineer needs to enforce this across the organization. Which approach is MOST effective?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance is launched with the required IAM role, and attach it to all users. Using an IAM policy with a condition that denies instance launch unless a specific IAM role is attached. Option A is wrong because it only restricts instance profiles, not the launch. Option B is wrong because SCPs cannot enforce a specific role attachment. Option D is wrong because instance metadata service does not enforce roles.

Answer

Create an SCP that denies ec2:RunInstances if the specified IAM role is not the approved role

Answer

Create a service control policy (SCP) that denies the ec2:RunInstances action unless an instance profile is attached

Answer

Use AWS Config to detect instances without the required role and terminate them via Lambda