DOP-C02 Security and Compliance Practice Test 15 — 15 Questions

Question 1

A company requires that all secrets (e.g., database passwords) used by Lambda functions be rotated automatically every 30 days. Which combination of services should be used?

Accepted Answer

AWS Secrets Manager and AWS Lambda. AWS Secrets Manager is the correct choice because it natively supports automatic secret rotation on a configurable schedule (e.g., every 30 days) using a Lambda function as the rotation handler. Secrets Manager directly integrates with Lambda to invoke the rotation logic, updating the secret value and propagating the change to the target database or service without custom infrastructure. CloudHSM, Parameter Store, and KMS do not provide built-in, scheduled rotation of secrets with automatic Lambda invocation.

Answer

AWS CloudHSM and AWS Lambda

Answer

AWS Systems Manager Parameter Store and AWS Lambda

Answer

AWS KMS and AWS Lambda

Question 2

An organization wants to grant cross-account access to an S3 bucket in Account A to a user in Account B. Which policy configuration is required?

Accepted Answer

A bucket policy in Account A and an IAM user policy in Account B. Cross-account access to an S3 bucket requires both a resource-based policy (bucket policy) on the bucket in Account A granting access to the user in Account B, and an identity-based policy (IAM user policy) in Account B allowing the user to access the bucket. Option A correctly includes both policies. Option B is incorrect because S3 bucket ACLs are legacy and not recommended for cross-account access. Option C is missing the bucket policy in Account A, so it is insufficient. Option D is missing the IAM user policy in Account B, so it is insufficient.

Answer

An S3 bucket ACL granting access to the user in Account B

Answer

An IAM user policy in Account B allowing access to the bucket

Answer

A bucket policy in Account A granting access to the user in Account B

Question 3

A security audit reveals that an S3 bucket contains objects that are not encrypted. The bucket is configured with default encryption using SSE-S3. What is the most likely reason that objects are unencrypted?

Accepted Answer

The objects were uploaded before default encryption was enabled. Default encryption applies only to newly uploaded objects that do not have encryption settings. If objects were uploaded before default encryption was enabled, or if the PUT request explicitly specified no encryption, they may remain unencrypted. Option A is wrong because SSE-S3 does not require KMS. Option B is wrong because default encryption applies to new objects. Option D is wrong because SSE-C is not relevant.

Answer

The objects were uploaded with server-side encryption using AWS KMS

Answer

The bucket policy denies SSE-S3 encryption

Answer

The objects were uploaded with SSE-C

Question 4

A company has a requirement to store audit logs for 7 years. The logs are currently stored in Amazon S3 and are accessed infrequently. Which storage class provides the lowest cost while meeting the retention requirement?

Accepted Answer

S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest-cost storage class for long-term retention of data that is accessed rarely. Option A (S3 Intelligent-Tiering) may move data but has monitoring costs. Option B (S3 Standard) is expensive for long-term. Option D (S3 One Zone-IA) is not for long-term durability.

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Answer

S3 One Zone-Infrequent Access

Question 5

A company is designing a secure CI/CD pipeline. Which TWO actions should be taken to protect secrets (e.g., API keys) used in the pipeline? (Choose TWO.)

Accepted Answer

Store secrets in AWS Secrets Manager. AWS Secrets Manager stores and rotates secrets securely. IAM roles should be used to grant access to secrets without hardcoding. Storing secrets in buildspec or environment variables is insecure. Using KMS to encrypt secrets is good, but the question asks for TWO best practices: using Secrets Manager and IAM roles.

Answer

Encrypt secrets with AWS KMS and store the encrypted value in the source code

Answer

Store secrets in plaintext in the buildspec file

Answer

Pass secrets as environment variables in the build

Question 6

A DevOps team needs to enforce that all S3 buckets in an AWS account are encrypted at rest. Which THREE steps should be taken to achieve this? (Choose THREE.)

Accepted Answer

Configure AWS Config rules to detect buckets without encryption. To enforce encryption at rest for all S3 buckets, three steps are needed: (A) AWS Config rules can detect buckets without encryption, providing visibility and enforcement through remediation; (B) an S3 bucket policy that denies PutObject requests lacking encryption headers ensures objects are encrypted when uploaded; (D) enabling default encryption on each bucket ensures that new objects are encrypted even if the upload does not specify encryption. Together, these cover detection, prevention, and default behavior. Option C (server access logging) is for auditing access, not encryption. Option E (Transfer Acceleration) improves transfer speed, not encryption.

Answer

Enable S3 server access logging

Answer

Enable S3 Transfer Acceleration

Question 7

A company is using AWS KMS to encrypt data. Which TWO statements about AWS KMS key rotation are correct? (Choose TWO.)

Accepted Answer

Customer managed keys can be configured for automatic rotation. Customer managed keys can have automatic rotation enabled, but it is not enabled by default (option A is correct). AWS managed keys are automatically rotated every year (option E is correct). Option B is incorrect because imported key material does not support automatic rotation. Option C is incorrect because automatic rotation is not enabled by default for customer managed keys. Option D is incorrect because automatic rotation cannot be disabled for AWS managed keys.

Answer

Keys imported into KMS support automatic rotation

Answer

Automatic rotation is enabled by default for customer managed keys

Answer

Automatic rotation can be disabled for AWS managed keys

Question 8

Refer to the exhibit. A security team wants to enforce that passwords expire after 60 days. Which action should be taken?

Accepted Answer

Use the update-account-password-policy CLI command with --max-password-age 60. The current MaxPasswordAge is 90 days. To change it to 60, use the update-account-password-policy command. Option A is wrong because that command changes other settings. Option B is wrong because the policy is account-level. Option C is wrong because the CLI can modify the policy.

Answer

Use the AWS Management Console to change the password policy for each IAM user

Answer

Create a new IAM user and set the password policy on that user

Answer

Delete the current password policy and create a new one

Question 9

Refer to the exhibit. A user outside the 192.0.2.0/24 IP range attempts to get an object from example-bucket. What will happen?

Accepted Answer

The request is denied because the Deny statement applies. The Deny statement explicitly denies all S3 actions if the IP is not in the allowed range. Since the user is outside, the Deny applies, overriding the Allow. Option A is wrong because the Deny blocks access. Option B is wrong because the Deny is explicit. Option C is wrong because the policy is not malformed.

Answer

The request is allowed because the Allow statement matches

Answer

The request is allowed because there is no explicit Deny for GetObject

Answer

The request is denied because the policy is malformed

Question 10

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most likely security concern?

Accepted Answer

The bucket is now publicly accessible. The CloudTrail log entry shows a PutBucketPolicy action that sets a bucket policy with principal '*', granting public read access to all objects in the bucket. This is a security concern because the bucket becomes publicly accessible, allowing anyone on the internet to read objects. Option A is correct because the bucket policy makes the bucket publicly accessible. Option B is incorrect because the bucket policy does not grant the root user full access; it grants public access. Option C is incorrect because the action is performed by an IAM user (the user field shows 'arn:aws:iam::123456789012:user/admin'), not the root user. Option D is incorrect because the policy allows all principals (public) to read objects, not just authenticated users.

Answer

The bucket policy grants the root user full access

Answer

The root user performed an action that should have been done by an IAM user

Answer

The bucket policy allows only authenticated users to read objects

Question 11

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application stores sensitive user data in an S3 bucket. A Security Engineer needs to ensure that the EC2 instances can only access the specific S3 bucket and no other AWS services. Which solution meets these requirements?

Accepted Answer

Create an IAM role with a policy that grants s3:PutObject and s3:GetObject access to the specific bucket, and attach the role to the EC2 instances as an instance profile.. Creating an IAM role with a policy that grants s3:PutObject and s3:GetObject access only to the specific S3 bucket, and attaching that role to the EC2 instances as an instance profile, ensures that the instances can only access that bucket. This method uses AWS Identity and Access Management (IAM) to restrict permissions per resource. Option A is incorrect because an S3 bucket policy restricting access to the ALB's security group cannot control what the instances themselves do; the instances can still access S3 directly if they have credentials. Option C is incorrect because a VPC endpoint for S3 provides private connectivity but does not restrict which resources the instances can access; it only ensures traffic stays within the AWS network. Option D is incorrect because security groups cannot filter traffic based on S3 bucket names or policies; they only filter IP addresses and ports, and S3 uses HTTPS which is not restrictable by security group to a specific bucket.

Answer

Attach a bucket policy to the S3 bucket that allows access only from the ALB's security group.

Answer

Configure a VPC endpoint for S3 and modify the route table to route S3 traffic through the endpoint.

Answer

Create a security group that allows outbound HTTPS traffic only to the S3 bucket's IP address range.

Question 12

A company uses AWS Organizations with multiple accounts. The Security team needs to enforce that all newly created S3 buckets in any account are configured with server-side encryption (SSE-S3 or SSE-KMS) and block public access. Which approach should be used?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:CreateBucket unless the request includes the x-amz-server-side-encryption header and the PublicAccessBlockConfiguration.. Service control policies (SCPs) in AWS Organizations can be applied to the root organizational unit to centrally enforce conditions on API calls across all accounts. An SCP that denies s3:CreateBucket unless the request includes the x-amz-server-side-encryption header and the PublicAccessBlockConfiguration prevents noncompliant buckets from being created. Option A is incorrect because CloudTrail and Lambda provide reactive remediation, not preventive enforcement. Option B is incorrect because IAM policies must be applied per account and cannot be centrally enforced across all accounts. Option D is incorrect because AWS Config rules are detective and, even with automatic remediation, they act after the bucket is already created, which may not meet the requirement to enforce compliance at creation time.

Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to remediate noncompliant buckets.

Answer

Create an IAM policy in each account that denies s3:CreateBucket unless encryption is specified and public access is blocked.

Answer

Use AWS Config rules with automatic remediation to delete or remediate noncompliant buckets after creation.

Question 13

A DevOps engineer needs to securely store and automatically rotate database credentials for a MySQL RDS instance. The credentials should be accessible to a Lambda function without hardcoding them. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it allows you to store secrets, automatically rotate them for supported RDS databases, and retrieve them programmatically via the Lambda runtime using the Secrets Manager API. AWS Systems Manager Parameter Store can store secrets but does not natively support automatic rotation for RDS. AWS KMS is used for managing encryption keys, not storing secrets. IAM roles for EC2 provide permissions to EC2 instances but cannot store credentials.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

IAM roles for EC2

Question 14

A company uses AWS CodeBuild to build and test code. The build process requires access to a private PyPI repository hosted on an internal network. The CodeBuild project is configured with a VPC. However, the build fails with a timeout error when trying to connect to the PyPI repository. The security group for the CodeBuild project allows outbound HTTPS to 0.0.0.0/0. What is the most likely cause?

Accepted Answer

The security group for the PyPI repository does not allow inbound traffic from the CodeBuild security group.. The private PyPI repository is hosted on an internal network accessible via the VPC. The CodeBuild project is configured with a VPC and its security group allows outbound HTTPS to 0.0.0.0/0. However, the repository's security group must also allow inbound HTTPS traffic from the CodeBuild security group. If that inbound rule is missing, the connection will be blocked, causing a timeout. Option A is incorrect because CodeBuild fully supports VPC connectivity. Option B is incorrect because a NAT gateway would route traffic to the internet, but the repository is internal; this could cause a timeout, but it's less likely than a missing inbound rule. Option D is incorrect because if the subnet had no route to the internal network, the build would likely fail with a different error (e.g., no route to host) rather than a timeout; however, the most likely cause in practice is the missing inbound rule on the repository side.

Answer

CodeBuild does not support VPC connectivity.

Answer

The VPC subnet has a NAT gateway that routes traffic to the internet instead of the internal network.

Answer

The VPC subnet does not have a route to the internal network.

Question 15

A company is using AWS CodePipeline to deploy a web application across multiple AWS accounts using CloudFormation stack sets. The pipeline is in the tools account, and it deploys to production account. The security team requires that all CloudFormation changes to production account be reviewed and approved by a senior engineer. Which approach meets this requirement?

Accepted Answer

Add a manual approval step in the CodePipeline before the CloudFormation deployment stage.. Adding a manual approval step in CodePipeline before the CloudFormation deployment stage allows a senior engineer to review and approve changes, meeting the security requirement. Option A is incorrect because CloudTrail only logs actions after they occur and does not provide a review mechanism. Option B is incorrect because denying CloudFormation actions to all but a specific role would prevent the pipeline from deploying unless it uses that role, but it does not enforce a manual review process. Option D is incorrect because SCPs are preventive controls that block actions, not a mechanism for manual approval.

Answer

Use AWS CloudTrail to monitor deployments and send notifications for review.

Answer

Configure an IAM policy that denies CloudFormation actions in the production account except for a specific role used by the senior engineer.

Answer

Use a service control policy (SCP) to prevent CloudFormation changes from the tools account.