DOP-C02 Security and Compliance Practice Test 13 — 15 Questions

Question 1

A DevOps engineer is tasked with auditing all AWS API calls made in the account for compliance purposes. The engineer needs to ensure that the audit logs are tamper-proof and stored cost-effectively. Which TWO services should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it is the service that records all AWS API activity in an account as event logs, which is exactly what is needed to audit API calls for compliance. Amazon S3 with Object Lock enabled (C) is correct because CloudTrail delivers its logs to an S3 bucket, and S3 Object Lock provides WORM (write-once-read-many) protection so the logs cannot be altered or deleted, while S3 storage classes keep the cost low for long-term retention. AWS Config (A) is not correct because it records resource configuration changes and compliance state, not the full set of API calls. Amazon CloudWatch Logs (D) is not correct because it is a log storage and monitoring service, not the API audit trail itself, and it lacks the immutable WORM guarantee. AWS KMS (E) is not correct because it provides encryption key management, which supports security but does not by itself create tamper-proof, cost-effective audit logs.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

AWS KMS

Question 2

A company has a multi-account AWS environment managed by AWS Organizations. The DevOps team uses AWS CloudFormation StackSets to deploy a standard VPC across all member accounts. The security team has noticed that in some accounts, the VPC is being modified after deployment, allowing inbound SSH access from the internet. The team wants to automatically detect and remediate these changes. The current setup includes: AWS Config enabled in all accounts with a rule that checks for unrestricted SSH access; an SNS topic in the management account that receives compliance change notifications; and a Lambda function in the management account that can remediate by updating the security group rules. However, the remediation is not working consistently. What is the most likely reason, and what is the best solution?

Accepted Answer

The Lambda function's IAM role does not have permissions to modify security groups in member accounts.. The Lambda function in the management account needs cross-account permissions to modify security groups in member accounts. The most likely issue is that the Lambda function's IAM role does not have the required permissions. The best solution is to use AWS Config conformance packs with remediation actions deployed to each member account, allowing local remediation. Option A is incorrect because the Config rule itself detects the changes. Option C is incorrect because the SNS topic can deliver messages cross-account with proper permissions, but the remediation fails due to the Lambda role's lack of permissions. Option D is incorrect because StackSets are for initial deployment, not for ongoing compliance.

Answer

The AWS Config rule is not evaluating correctly in member accounts.

Answer

The SNS topic is not delivering messages to the Lambda function due to cross-account access issues.

Answer

CloudFormation StackSets is overriding the changes, causing a race condition.

Question 3

A company is using AWS Secrets Manager to store database credentials for a multi-tier application. The application runs on EC2 instances in an Auto Scaling group. The DevOps engineer has configured the instances to retrieve the secret at boot time using a script that calls the AWS CLI. Recently, the security team discovered that the secret was exposed in the instance's user data logs. The engineer needs to implement a more secure method to access the secret without storing it in user data. The application code can be modified. The environment uses IAM roles for EC2. Which solution best meets the security requirements?

Accepted Answer

Modify the application code to use the AWS SDK to retrieve the secret from Secrets Manager using the instance's IAM role.. The most secure and operationally sound approach is to have the application retrieve the secret at runtime using the AWS SDK, authenticating via the EC2 instance profile (IAM role). This eliminates any need to embed the secret in user data, config files, or environment variables, and it leverages Secrets Manager's native rotation, versioning, and audit trail. Because the environment already uses IAM roles for EC2, no additional credential management is required.

Answer

Store the secret in a configuration file on the EC2 instance and encrypt the file system.

Answer

Store the secret in AWS Systems Manager Parameter Store and retrieve it via the AWS CLI at boot time.

Answer

Use a KMS key to encrypt the secret and store the encrypted value in user data.

Question 4

A DevOps engineer needs to grant an IAM user temporary access to an S3 bucket for exactly one hour. Which AWS service should be used to generate temporary credentials?

Accepted Answer

AWS STS. AWS STS (Security Token Service) is the service that issues temporary, limited-privilege credentials via APIs like AssumeRole, GetSessionToken, and GetFederationToken. To grant an IAM user one-hour access to an S3 bucket, the engineer calls AssumeRole (or AssumeRoleWithSAML/WebIdentity) with a DurationSeconds of 3600 and attaches a scoped policy. STS returns an access key, secret key, and session token that expire automatically, which is exactly the temporary-credential requirement.

Answer

Amazon Cognito

Answer

AWS SSO

Answer

AWS IAM

Question 5

Refer to the exhibit. An IAM policy is attached to a user. The user requests an object from the 'example-bucket' bucket, specifically from the 'confidential' folder, over HTTP (not HTTPS). The source IP is within the 10.0.0.0/24 range. What will be the result of this request?

Accepted Answer

Denied, because the request uses HTTP and the Deny statement blocks it.. The IAM policy includes a Deny statement that blocks s3:GetObject when the request is not over HTTPS (aws:SecureTransport is false). Since the request uses HTTP, the condition evaluates to true and the explicit Deny overrides any Allow. Therefore the request is denied regardless of the source IP being in the allowed range.

Answer

Denied, because the user does not have s3:GetObject permission on the confidential folder.

Answer

Allowed, because the Deny statement only applies to HTTPS.

Answer

Allowed, because the source IP is within the allowed range.

Question 6

A company uses AWS Secrets Manager to store database credentials. The security team requires that secrets be automatically rotated every 30 days. Which rotation strategy should the engineer configure to meet this requirement with minimal operational overhead?

Accepted Answer

Enable automatic rotation using the pre-built Lambda rotation function for the database type.. AWS Secrets Manager supports automatic rotation using pre-built Lambda rotation functions tailored to specific database types (e.g., Amazon RDS MySQL, PostgreSQL, Aurora). Enabling this built-in rotation with a 30-day schedule meets the requirement with minimal operational overhead because AWS manages the Lambda function, rotation logic, and secret update. This is the standard, lowest-effort approach for database credential rotation.

Answer

Manually rotate the secret every 30 days using the AWS CLI.

Answer

Store the secret in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Enable automatic rotation with a custom Lambda function.

Question 7

A company is deploying a multi-tier application on AWS. The web tier must be publicly accessible, but the application tier must only be accessible from the web tier. The database tier should not be accessible from the internet at all. Which combination of security groups and network ACLs should be used?

Accepted Answer

Use security groups: allow 0.0.0.0/0 on port 80/443 to web tier, allow web tier security group to app tier, allow app tier security group to database tier.. The correct approach is to use security groups that enforce least privilege: allow public access to the web tier on ports 80/443, allow the web tier security group to access the app tier, and allow the app tier security group to access the database tier. This creates a chain of trust where each tier only accepts traffic from the previous tier.

Answer

Use security groups: allow 0.0.0.0/0 on all ports to web tier, allow all traffic between all instances.

Answer

Place all instances in the same security group with inbound rules allowing only ports 80/443 from 0.0.0.0/0.

Answer

Use network ACLs: allow 0.0.0.0/0 on port 80/443 to web subnet, allow web subnet to app subnet, allow app subnet to database subnet.

Question 8

A company wants to ensure that all S3 buckets are encrypted at rest by default. Which S3 feature should be enabled at the bucket level to automatically encrypt new objects?

Accepted Answer

Default encryption. S3 default encryption allows you to set a default encryption behavior for a bucket, so that all new objects are encrypted at rest automatically. Bucket policies can enforce encryption but do not automatically encrypt. Object lock is for retention. Versioning is for object versions.

Answer

S3 Object Lock

Answer

Bucket policy with a Deny for unencrypted uploads

Answer

S3 Versioning

Question 9

A company uses Amazon Inspector to scan EC2 instances for vulnerabilities. The security team discovers that a critical vulnerability is present on an instance, but the instance is part of an Auto Scaling group. What is the MOST efficient way to remediate this vulnerability while ensuring the Auto Scaling group remains operational?

Accepted Answer

Create a new AMI with the patch, update the Auto Scaling group's launch template, and terminate instances one by one to trigger replacement.. The immutable-infrastructure approach — build a patched AMI, update the Auto Scaling group's launch template, and roll instances — ensures every new instance is born patched and the ASG maintains capacity throughout. Terminating instances one by one triggers replacement with the new AMI while the group stays operational.

Answer

Patch the instance manually via SSH, then create a new AMI from it and update the launch configuration.

Answer

Detach the instance from the Auto Scaling group, patch it, and reattach it.

Answer

Use AWS Systems Manager Patch Manager to patch the instance and then set the instance to not receive future updates.

Question 10

Which TWO actions should a DevOps engineer take to prevent an S3 bucket from being publicly accessible? (Choose two.)

Accepted Answer

Enable S3 Block Public Access at the bucket level.. Enabling S3 Block Public Access at the bucket level provides a centralized, override-proof mechanism to prevent any public access to the bucket, regardless of other policies or ACLs. This setting blocks all public access by default, including access granted via bucket policies, access control lists (ACLs), or object-level permissions, and cannot be overridden by any other S3 configuration.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable S3 Server Access Logging.

Answer

Configure a lifecycle policy to delete objects.

Question 11

Which TWO AWS services can be used to monitor for unauthorized API calls in an AWS account? (Choose two.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (D) is correct because it records every API call made in the account as events, including the identity of the caller, source IP, and time, which lets you detect unauthorized or suspicious API activity. Amazon GuardDuty (E) is correct because it continuously analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs using threat intelligence and machine learning to surface findings such as anomalous or unauthorized API calls. AWS Config (A) is not the right choice because it evaluates resource configuration compliance and records configuration changes, not the authorization status of API callers. Amazon S3 (B) is only object storage and does not monitor API activity. Amazon CloudWatch Logs (C) can store and query log data, but by itself it does not capture or detect unauthorized API calls without CloudTrail as the source.

Answer

AWS Config

Answer

Amazon S3

Answer

Amazon CloudWatch Logs

Question 12

Which THREE of the following are valid methods to enforce encryption at rest for Amazon EBS volumes? (Choose three.)

Accepted Answer

Enable EBS encryption by default in the account.. Enabling EBS encryption by default at the account level ensures all new volumes are encrypted. You can also encrypt volumes when creating them via the console or CLI. You cannot encrypt an existing volume directly; you must create a snapshot, copy it with encryption, and create a new volume. Attaching a volume does not encrypt it.

Answer

Use the AWS CLI to encrypt an existing volume in place.

Answer

Attach the volume to an EC2 instance and use OS-level encryption.

Question 13

Which TWO of the following are benefits of using AWS Certificate Manager (ACM) to manage SSL/TLS certificates? (Choose two.)

Accepted Answer

Automatic renewal of certificates.. Option C is correct because ACM automatically renews certificates that it issued and manages, as long as the certificate is in use and the domain validation remains valid, eliminating manual renewal overhead. Option D is correct because ACM certificates can be directly associated with Elastic Load Balancing (ALB/NLB) and Amazon CloudFront distributions, enabling seamless deployment of TLS termination without exporting private keys. Option A is not a listed benefit because ACM-issued public certificates cannot be exported or installed directly on EC2 instances; you must use services like ELB, CloudFront, or API Gateway. Option B is incorrect because ACM supports both wildcard and non-wildcard (single-domain and multi-domain/SAN) certificates. Option E is incorrect because ACM public certificates are free only for integrated AWS services, not for arbitrary AWS services or exportable use, and ACM Private CA certificates incur cost.

Answer

Ability to use the same certificate on multiple EC2 instances.

Answer

Support for wildcard certificates only.

Answer

Free certificates for use on any AWS service.

Question 14

A company uses AWS Lambda functions to process sensitive data from an SQS queue. The Lambda function writes results to an S3 bucket. The security team requires that all data at rest in S3 be encrypted with a customer managed KMS key, and that the Lambda function only have access to decrypt the queue messages and encrypt the S3 objects. An IAM role is attached to the Lambda function. The engineer has configured the KMS key policy to allow the Lambda role to use the key. However, the Lambda function fails to write to S3 with a 'KMS access denied' error. The engineer verified that the S3 bucket has default encryption enabled with the same KMS key. Which additional step is most likely required?

Accepted Answer

Add an inline policy to the Lambda role that allows kms:GenerateDataKey and kms:Encrypt actions for the KMS key.. The KMS key policy alone is not sufficient — IAM policies must also grant the caller permission to use the key. When Lambda writes to an S3 bucket with SSE-KMS default encryption, S3 calls kms:GenerateDataKey on behalf of the Lambda execution role to obtain a data key for envelope encryption. Without kms:GenerateDataKey (and typically kms:Encrypt) in the Lambda role's identity-based policy, the request fails with 'KMS access denied' even though the key policy allows the role.

Answer

Disable default encryption on the S3 bucket and configure the Lambda to use SSE-S3.

Answer

Grant the Lambda role s3:PutObject permission on the bucket.

Answer

Modify the KMS key policy to allow the Lambda role to use the key without any conditions.

Question 15

A company wants to enable AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team requires that logs be encrypted at rest and that any unauthorized deletion of log files be prevented. Which TWO actions should the security team take? (Choose TWO.)

Accepted Answer

Create a trail in the management account that applies to all accounts in the organization.. Enabling CloudTrail for all accounts in the organization ensures centralized logging. Option D is correct because S3 Object Lock prevents deletion of log files. Option B is incorrect because KMS with a customer managed key provides encryption, but the key must be created beforehand, not just enabled. Option C is incorrect because CloudWatch Logs encryption uses KMS, not S3 SSE. Option E is incorrect because CloudTrail can be configured to log management events by default, and this is not about data events.

Answer

Enable default encryption with SSE-S3 on the S3 bucket where CloudTrail delivers logs.

Answer

Configure CloudTrail to send logs to Amazon CloudWatch Logs and enable encryption using an AWS KMS key.

Answer

Enable CloudTrail Insights to detect unusual API activity.