DOP-C02 Security and Compliance Practice Test 14 — 15 Questions

Question 1

An S3 bucket has the above bucket policy. What is the effect of this policy?

Accepted Answer

It denies access to the bucket if the request is not sent over HTTPS. The bucket policy denies all S3 actions when the request is not sent over HTTPS (i.e., when aws:SecureTransport is false). Therefore, the policy enforces HTTPS for all access to the bucket. Option C correctly states this effect. Option A is incorrect because the policy does not allow anonymous access; it only denies non-HTTPS requests. Option B is incorrect because the policy does not deny all access; it only denies requests that are not HTTPS. Option D is incorrect because the policy does not reference IP addresses.

Answer

It allows anonymous access to the bucket over HTTPS

Answer

It denies all access to the bucket regardless of protocol

Answer

It allows access only from specific IP addresses

Question 2

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can make changes to Amazon CloudWatch Logs configurations. Which approach should be used?

Accepted Answer

Create an SCP that denies cloudwatch:Put* and cloudwatch:Delete* actions and attach it to the root OU. Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By attaching an SCP that denies cloudwatch:Put* and cloudwatch:Delete* actions to the root OU, you ensure that no IAM user or role in any account can modify or delete CloudWatch Logs configurations, regardless of any IAM policies attached directly to users or roles. This approach provides a guardrail that cannot be overridden by account administrators.

Answer

Use AWS Config rules to automatically revert changes to CloudWatch Logs

Answer

Create an IAM policy that denies changes to CloudWatch Logs and apply it to all IAM users

Answer

Use AWS CloudTrail to monitor and alert on changes to CloudWatch Logs

Question 3

A DevOps engineer needs to securely store and automatically rotate database credentials for a web application running on Amazon ECS. Which solution should be used?

Accepted Answer

Store the credentials in AWS Secrets Manager and configure rotation. Grant the ECS task IAM role permission to retrieve the secret.. AWS Secrets Manager can store database credentials and automatically rotate them on a schedule. The ECS task can retrieve the credentials using the Secrets Manager secret. Option C is correct. Option A (AWS KMS) is for encryption keys, not credential rotation. Option B (SSM Parameter Store) can store secrets but does not support automatic rotation. Option D (AWS Certificate Manager) is for SSL/TLS certificates.

Answer

Use AWS KMS to generate and rotate a data key for encrypting the credentials in a file on ECS.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString. Use a Lambda function to rotate them.

Answer

Use AWS Certificate Manager to store the credentials as a certificate.

Question 4

Given the above IAM policy, which action is permitted?

Accepted Answer

Invoke the Lambda function MyFunction in us-east-1 account 123456789012. The policy explicitly allows the lambda:InvokeFunction action on the specified function ARN. Option A is correct. It does not allow other Lambda actions (B), S3 actions (C), or EC2 actions (D).

Answer

Read objects from an S3 bucket

Answer

Create a Lambda function

Answer

Start an EC2 instance

Question 5

Which TWO actions are best practices for securing an AWS account root user? (Select TWO.)

Accepted Answer

Create an IAM user with administrator access and use that instead. Best practices for root user include enabling MFA, using a strong password, and not using root for daily tasks. Deleting the root user is not possible. Access keys should not be created for root user.

Answer

Use the root user for daily administrative tasks

Answer

Create access keys for the root user to use with CLI

Answer

Delete the root user after creating an IAM admin user

Question 6

Which THREE AWS services can be used to centrally manage and enforce security policies across multiple accounts in AWS Organizations? (Select THREE.)

Accepted Answer

AWS Config Conformance Packs. AWS Config Conformance Packs enable you to deploy and enforce a collection of AWS Config rules and remediation actions across multiple accounts and Regions in an AWS Organization. They provide a centralized way to ensure that resources comply with internal policies by using a YAML template that defines the rules and parameters, which are then applied to all member accounts via AWS Config aggregators and StackSets.

Answer

AWS Systems Manager

Answer

AWS CloudTrail

Question 7

Which TWO measures can be taken to protect data at rest in Amazon S3? (Select TWO.)

Accepted Answer

Enable S3 Server-Side Encryption (SSE-S3 or SSE-KMS). S3 Server-Side Encryption (SSE) and S3 Bucket Policies to deny unencrypted PUT requests are measures to protect data at rest. MFA Delete protects against accidental deletion, not encryption. Cross-region replication is for disaster recovery. S3 Transfer Acceleration speeds up uploads.

Answer

Enable cross-region replication

Answer

Enable MFA Delete on the bucket

Answer

Use S3 Transfer Acceleration

Question 8

An S3 bucket has the above bucket policy. What is the net effect on GetObject requests?

Accepted Answer

Only requests from IP range 192.0.2.0/24 are allowed. The Allow statement grants public read access. The Deny statement denies all S3 actions when the source IP is not in 192.0.2.0/24. Since a Deny overrides an Allow, only requests from within that IP range are allowed. Option C is correct.

Answer

All anonymous users can read objects

Answer

All requests are denied

Answer

Only authenticated users can read objects

Question 9

A company needs to enforce that all EC2 instances launched in an AWS account use a specific Amazon Machine Image (AMI) that is approved by the security team. Which combination of services should be used?

Accepted Answer

AWS Config rule to check AMI ID and AWS Systems Manager Automation to remediate non-compliant instances. AWS Config can detect non-compliant instances and AWS Systems Manager Automation can automatically remediate by stopping or terminating them. Option B is correct. Option A (SCP) cannot enforce AMI IDs. Option C (CloudTrail) only logs. Option D (Lambda) could be used but is not the primary service.

Answer

AWS Organizations SCP and AWS CloudTrail

Answer

AWS Lambda and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Events

Question 10

A company wants to centrally manage and audit access to AWS KMS keys across multiple accounts. Which AWS feature should be used?

Accepted Answer

AWS CloudTrail with organization trail. AWS CloudTrail with an organization trail can log all API calls, including KMS key usage, across multiple accounts in an AWS Organization. This provides centralized audit logging for KMS key access. Option A (AWS Config aggregated rules) can evaluate resource compliance but does not audit key usage. Option B (Cross-account IAM roles) allows access but not centralized auditing. Option D (AWS Organizations tag policies) manage tags, not auditing. Therefore, option C is correct.

Answer

AWS Config aggregated rules

Answer

Cross-account IAM roles

Answer

AWS Organizations tag policies

Question 11

A company wants to ensure that all API calls made within its AWS account are logged for auditing purposes. Which AWS service should be enabled to meet this requirement?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, making it the correct choice. Option A is incorrect because AWS Config tracks resource configuration changes, not API calls. Option C is incorrect because CloudWatch Logs is for log storage and monitoring, not for recording API calls. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

VPC Flow Logs

Question 12

A DevOps engineer needs to encrypt data at rest in an Amazon S3 bucket that stores sensitive customer information. The company requires that the encryption key be managed by AWS and rotated automatically. Which encryption option should be used?

Accepted Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3). SSE-S3 uses AWS-managed keys and automatically rotates them, meeting the requirement. Option A (SSE-C) requires customer-managed keys and no automatic rotation. Option B (SSE-KMS with customer-managed key) does not automatically rotate unless configured. Option D (client-side encryption) does not use AWS-managed keys.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS) using a customer-managed key

Answer

Client-side encryption with an AWS KMS managed key

Question 13

A company uses AWS Organizations with multiple accounts. The security team wants to restrict the use of specific instance types across all accounts to reduce costs and enforce compliance. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit to deny the instance types. Service control policies (SCPs) in AWS Organizations allow central control over permissions across all accounts, including the ability to deny specific instance types. This prevents any account from launching the restricted instance types. Option A is incorrect because AWS Config rules can only detect non-compliant resources, not prevent their creation. Option C is incorrect because IAM policies applied within individual accounts can be overridden by account administrators, and managing policies per account is not scalable. Option D is incorrect because AWS CloudFormation templates can enforce instance types only within stacks that use the template, but they do not prevent users from launching instances outside of CloudFormation.

Answer

Use AWS Config rules to detect non-compliant instance types

Answer

Create IAM policies in each account to deny the use of the instance types

Answer

Use AWS CloudFormation templates to enforce instance type selection

Question 14

A company is using Amazon RDS for MySQL and needs to encrypt the database at rest. Which action should be taken to enable encryption?

Accepted Answer

Enable encryption when creating the DB instance. Encryption at rest for Amazon RDS MySQL can only be enabled during the creation of the DB instance. Once the instance is created, encryption cannot be added. Option A is incorrect because while you can create an encrypted read replica from an unencrypted source, that does not encrypt the original instance. Option B is incorrect because AWS Secrets Manager is used for managing database credentials, not for encrypting data at rest. Option D is incorrect because modifying an existing DB instance does not support enabling encryption; the instance must be created with encryption enabled.

Answer

Create a read replica with encryption enabled

Answer

Use AWS Secrets Manager to encrypt the data

Answer

Modify the existing DB instance and enable encryption

Question 15

A DevOps engineer receives an alert that an EC2 instance has been compromised. The instance is part of an Auto Scaling group. What is the first step the engineer should take to isolate the instance?

Accepted Answer

Detach the instance from the Auto Scaling group and remove it from the load balancer. The first step to isolate a compromised EC2 instance in an Auto Scaling group is to detach it from the Auto Scaling group and remove it from the load balancer. This stops all incoming traffic to the instance, preventing further damage or data exfiltration while preserving the instance for forensic analysis. Option A (snapshot) is useful for preserving evidence but does not isolate the instance. Option C (AMI) similarly does not provide immediate isolation. Option D (terminate) may destroy evidence and should only be done after investigation.

Answer

Create a snapshot of the instance's root volume

Answer

Create an AMI of the instance for analysis

Answer

Terminate the instance immediately