DOP-C02 Security and Compliance Practice Test 13 — 15 Questions

Question 1

A company uses AWS Secrets Manager to rotate database credentials automatically. The rotation function is failing with a permission error. Which IAM policy should be attached to the Lambda execution role to allow Secrets Manager to invoke the rotation function?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"lambda:InvokeFunction","Resource":"*"}]}. None of the provided IAM policies enable Secrets Manager to invoke the Lambda function. Instead, a resource-based policy on the Lambda function must grant the `lambda:InvokeFunction` permission to the Secrets Manager service principal (secretsmanager.amazonaws.com).

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"lambda:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"secretsmanager:*","Resource":"*"}]}

Question 2

A DevOps engineer is troubleshooting a failed CodeBuild project. The build fails with an error: 'Access Denied: Unable to put object to S3.' The build project has an S3 bucket as the artifact store. What should the engineer do to resolve this issue?

Accepted Answer

Add s3:PutObject permission to the CodeBuild service role for the artifact bucket.. The CodeBuild service role requires the s3:PutObject permission on the artifact S3 bucket to upload build artifacts. Option B is incorrect because enabling server-side encryption does not grant write permissions; the issue is a missing IAM permission. Option C is incorrect because CloudWatch Logs are used for build logs, not for S3 access; enabling them does not resolve the access denied error. Option D is incorrect because s3:GetObject permission is for reading objects from a source bucket, not for writing artifacts. The error specifically indicates a failure to put an object into the artifact bucket, so the needed permission is s3:PutObject on that bucket.

Answer

Enable server-side encryption on the artifact bucket.

Answer

Enable CloudWatch Logs for the build project.

Answer

Add s3:GetObject permission to the CodeBuild service role for the source bucket.

Question 3

An organization wants to enforce that all Amazon S3 buckets are encrypted with SSE-S3. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config rules with auto-remediation. AWS Config rules with auto-remediation (Option B) can automatically remediate non-compliant S3 buckets by using a managed rule that checks for SSE-S3 encryption and an associated remediation action to apply encryption. AWS CloudTrail (Option A) only logs API calls and cannot remediate. IAM policies (Option C) can prevent future non-encrypted uploads but cannot remediate existing buckets. AWS Service Catalog (Option D) provisions approved resources but does not enforce encryption on existing buckets.

Answer

AWS CloudTrail

Answer

IAM policies

Answer

AWS Service Catalog

Question 4

A DevOps engineer needs to temporarily grant an external auditor read-only access to a specific S3 bucket for 24 hours. What is the most secure way to grant this access?

Accepted Answer

Generate a pre-signed URL for the objects and share the URL with the auditor.. A pre-signed URL grants time-limited, read-only access to specific S3 objects without sharing permanent credentials. The URL can be set to expire after 24 hours, aligning with the temporary access requirement. Option B is insecure because it creates a permanent IAM user. Option C is overly broad and permanent, not scoped to 24 hours. Option D violates security best practices by sharing access keys.

Answer

Create an IAM user with a policy granting read-only access to the bucket.

Answer

Add a bucket policy that grants read-only access to the auditor's AWS account.

Answer

Share the access keys of an existing IAM user with the auditor.

Question 5

A DevOps engineer is designing a secure CI/CD pipeline. Which TWO of the following are best practices for securing secrets in the pipeline?

Accepted Answer

Use encrypted environment variables in CodeBuild.. Options A and E are correct. Option A: CodeBuild allows environment variables to be encrypted using AWS KMS, which is a secure way to handle secrets in the pipeline. Option E: AWS Secrets Manager is a dedicated service for securely storing and retrieving secrets, and integrating it with the pipeline ensures secrets are not exposed. Option B is incorrect because storing secrets in a parameter file in the source repository exposes them to anyone with repository access, violating security best practices. Option C is incorrect because hardcoding secrets in CloudFormation template parameters can lead to exposure in logs or template outputs, and is not secure. Option D is incorrect because while S3 bucket policies can restrict access, they do not encrypt the secrets themselves, and S3 is not designed for managing secrets; AWS Secrets Manager or Parameter Store are better choices.

Answer

Store secrets in a parameter file in the source repository.

Answer

Hardcode secrets in CloudFormation template parameters.

Answer

Use S3 bucket policies to restrict access to secret files.

Question 6

A company wants to monitor and detect anomalous API calls in their AWS account. Which THREE AWS services should they use together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API calls made in the AWS account, providing the raw data needed to detect anomalous activity. By enabling CloudTrail on all regions and logging to a centralized S3 bucket, you capture the identity, source IP, and request parameters for every API call, which is essential for anomaly detection.

Answer

Amazon Inspector

Answer

AWS Config

Question 7

A DevOps engineer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. Which TWO methods can achieve this?

Accepted Answer

Enable encryption when creating the DB instance using a customer-managed KMS key.. Options A and B are correct because Amazon RDS for MySQL supports encryption at rest using AWS KMS. You can enable encryption when creating the DB instance with either a customer-managed KMS key (Option A) or the AWS managed KMS key (Option B). Option C is incorrect because RDS encryption always uses AWS KMS; there is no option to use a customer-managed key without KMS. Option D is incorrect because encryption cannot be enabled on an existing unencrypted DB instance; you must create a new encrypted instance and migrate the data. Option E is incorrect because client-side encryption is not a built-in RDS feature and would require application-level changes, not a direct method of encrypting data at rest in RDS.

Answer

Use the default RDS encryption with a customer-managed key without KMS.

Answer

Enable encryption on an existing unencrypted DB instance by modifying the instance.

Answer

Use client-side encryption with the RDS SDK.

Question 8

The IAM policy above is attached to a user. The user tries to stop an EC2 instance. What will happen?

Accepted Answer

The user can stop the instance.. The policy includes an explicit Allow for ec2:StopInstances on all resources, and the Deny statement only applies to ec2:TerminateInstances. Since the user is attempting to stop (not terminate) the instance, the Allow applies and there is no applicable Deny, so the action is permitted. Therefore, the user can stop the instance.

Answer

The user is denied due to an implicit deny.

Answer

The user cannot stop the instance because there is no explicit allow for all instances.

Answer

The user cannot stop the instance because the Deny statement overrides the Allow.

Question 9

A DevOps engineer runs the command above and gets the output shown. The engineer then tries to delete a versioned object from the bucket without using MFA. What will happen?

Accepted Answer

The delete request will fail with an AccessDenied error.. MFA Delete is enabled on the bucket, so any delete request for a versioned object without MFA will be denied with an AccessDenied error. Option B is incorrect: without MFA, the object cannot be permanently deleted. Option C is incorrect: a delete marker would be created only if the delete succeeded (which it does not) or if MFA were provided; here the request fails, so no delete marker is created. Option D is incorrect: creating a new version requires MFA as well, and the delete request fails.

Answer

The object will be permanently deleted.

Answer

The object will be deleted but can be recovered from the 'Delete Markers' list.

Answer

The object will be deleted and a new version will be created.

Question 10

The AWS Config rule 's3-bucket-ssl-requests-only' returns NON_COMPLIANT for the bucket 'my-bucket'. What does this mean?

Accepted Answer

The bucket's policy does not deny requests that are not using SSL.. The AWS Config rule 's3-bucket-ssl-requests-only' checks whether the bucket policy explicitly denies requests that are not using SSL (i.e., HTTP). A NON_COMPLIANT result indicates the bucket policy does not contain a deny effect for HTTP requests, meaning SSL-only access is not enforced. Option A correctly describes this condition. Option B is incorrect because the rule does not check public access. Option C is incorrect because server access logging is unrelated. Option D is incorrect because default encryption is not checked by this rule.

Answer

The bucket is publicly accessible.

Answer

The bucket does not have server access logging enabled.

Answer

The bucket does not have default encryption enabled.

Question 11

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service should be used to implement this rotation?

Accepted Answer

AWS Lambda with custom rotation logic. AWS Lambda with custom rotation logic is the correct service to automate IAM user access key rotation because AWS does not provide a native service that automatically rotates IAM access keys. AWS Secrets Manager can rotate secrets for databases and other services, but it does not support rotating IAM user access keys. Therefore, the recommended approach is to implement a custom Lambda function that generates new keys, updates the user, and manages the rotation lifecycle. Option B (AWS Config) only monitors compliance, not credentials. Option D (Systems Manager Parameter Store) stores secrets but lacks rotation capabilities for IAM keys.

Answer

AWS Config

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Question 12

A company needs to audit all changes to security groups in a multi-account environment. The logs must be centrally stored and immutable. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Enable AWS CloudTrail in all accounts, deliver logs to a central S3 bucket with S3 Object Lock enabled. AWS CloudTrail logs all API calls, including security group changes. Delivering CloudTrail logs from all accounts to a central S3 bucket with S3 Object Lock enabled ensures immutable storage. This meets the requirements with minimal operational overhead. Option A (VPC Flow Logs) logs network traffic, not security group changes. Option C (Amazon GuardDuty) is for threat detection and does not log all API calls. Option D (AWS Config) records configuration changes but not API calls; it can be used to detect changes but requires additional setup and does not provide the same API-level audit trail.

Answer

Enable VPC Flow Logs in each VPC and aggregate them in Amazon CloudWatch Logs

Answer

Enable Amazon GuardDuty and send findings to a central S3 bucket

Answer

Enable AWS Config rules to detect security group changes and store results in a central S3 bucket

Question 13

A DevOps engineer needs to grant cross-account access to an S3 bucket. The source account is 111111111111 and the target account is 222222222222. Which combination of a bucket policy and an IAM policy correctly grants the target account access?

Accepted Answer

Bucket policy: { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::222222222222:root" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" }. Cross-account S3 access requires a bucket policy in the source account (111111111111) that grants permissions to the target account (222222222222) by specifying the principal as the target account's root ARN (arn:aws:iam::222222222222:root), and an IAM policy in the target account that allows the user to perform the action on the bucket. Option B correctly provides both: the bucket policy uses the correct principal ARN, and the IAM policy allows s3:GetObject on the bucket. Option A is incorrect because 'Principal': '222222222222' is invalid; it must be an ARN. Option C lacks the IAM policy, and option D lacks the bucket policy.

Answer

Bucket policy: { "Effect": "Allow", "Principal": "222222222222", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: same as A

Answer

Only bucket policy as in A

Answer

Only IAM policy as in A

Question 14

Given the above AWS CLI command output, which actions are allowed for the specified policy?

Accepted Answer

ec2:DescribeInstances and s3:GetObject are allowed; s3:ListBucket is denied. The simulate-custom-policy command tests the specified policy against the given actions and resources. For ec2:DescribeInstances, the action is allowed because the policy includes ec2:Describe*. For s3:GetObject, the action is allowed because the policy explicitly allows s3:GetObject. For s3:ListBucket, the action is not allowed because the policy only allows s3:GetObject, not s3:ListBucket. Therefore, ec2:DescribeInstances and s3:GetObject are allowed, while s3:ListBucket is denied. Option B is correct.

Answer

Only s3:GetObject is allowed

Answer

Only ec2:DescribeInstances is allowed

Answer

All three actions are allowed

Question 15

A company has an Amazon RDS for MySQL database that stores sensitive data. The security team requires encryption at rest and in transit. Which combination of options meets these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance and enforce SSL connections. Encryption at rest for Amazon RDS is enabled by turning on RDS encryption when creating the instance. Encryption in transit is achieved by enforcing SSL/TLS connections for client connections to the database. Option C correctly combines both: enabling RDS encryption for at-rest security and enforcing SSL for in-transit security. Option A (AWS Certificate Manager) provides certificates but does not directly encrypt the RDS instance. Option B (private subnet with VPC peering) addresses network isolation, not encryption. Option D (client-side encryption with KMS) encrypts data before insertion but does not use RDS encryption and is not a standard RDS feature.

Answer

Use AWS Certificate Manager to issue a certificate for the RDS instance

Answer

Place the RDS instance in a private subnet and use VPC peering

Answer

Use AWS KMS to encrypt the database before inserting data and decrypt on read