DOP-C02 Security and Compliance Practice Test 15 — 15 Questions

Question 1

A DevOps engineer is troubleshooting a failed CodeBuild project. The build fails with an error: 'Access Denied: Unable to put object to S3.' The build project has an S3 bucket as the artifact store. What should the engineer do to resolve this issue?

Accepted Answer

Add s3:PutObject permission to the CodeBuild service role for the artifact bucket.. Option A is correct because the CodeBuild service role needs s3:PutObject permission. Option B is wrong because the issue is about writing artifacts, not reading source. Option C is wrong because CloudWatch Logs is for logs, not artifacts. Option D is wrong because KMS is for encryption, not direct write permission.

Answer

Enable server-side encryption on the artifact bucket.

Answer

Enable CloudWatch Logs for the build project.

Answer

Add s3:GetObject permission to the CodeBuild service role for the source bucket.

Question 2

An organization wants to enforce that all Amazon S3 buckets are encrypted with SSE-S3. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config rules with auto-remediation. Option D is correct because AWS Config with managed rules and auto-remediation can enforce encryption. Option A is wrong because IAM can deny non-encrypted put, but not remediate existing buckets. Option B is wrong because CloudTrail is for logging. Option C is wrong because Service Catalog is for provisioning approved resources.

Answer

AWS CloudTrail

Answer

IAM policies

Answer

AWS Service Catalog

Question 3

A DevOps engineer needs to temporarily grant an external auditor read-only access to a specific S3 bucket for 24 hours. What is the most secure way to grant this access?

Accepted Answer

Generate a pre-signed URL for the objects and share the URL with the auditor.. Option B is correct because a pre-signed URL grants time-limited access without sharing credentials. Option A is wrong because attaching a policy directly to the user grants permanent access. Option C is wrong because bucket policies are permanent. Option D is wrong because sharing access keys violates security best practices.

Answer

Create an IAM user with a policy granting read-only access to the bucket.

Answer

Add a bucket policy that grants read-only access to the auditor's AWS account.

Answer

Share the access keys of an existing IAM user with the auditor.

Question 4

A DevOps engineer is designing a secure CI/CD pipeline. Which TWO of the following are best practices for securing secrets in the pipeline?

Accepted Answer

Use encrypted environment variables in CodeBuild.. Options A and D are correct because AWS Secrets Manager is a secure service for storing secrets, and environment variables in CodeBuild can be encrypted. Option B is wrong because storing secrets in source code is insecure. Option C is wrong because S3 bucket policies do not encrypt secrets. Option E is wrong because hardcoding secrets in CloudFormation templates is insecure.

Answer

Store secrets in a parameter file in the source repository.

Answer

Hardcode secrets in CloudFormation template parameters.

Answer

Use S3 bucket policies to restrict access to secret files.

Question 5

A company wants to monitor and detect anomalous API calls in their AWS account. Which THREE AWS services should they use together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records all API calls made in the AWS account, providing the raw data needed to detect anomalous activity. By enabling CloudTrail on all regions and logging to a centralized S3 bucket, you capture the identity, source IP, and request parameters for every API call, which is essential for anomaly detection.

Answer

Amazon Inspector

Answer

AWS Config

Question 6

A DevOps engineer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. Which TWO methods can achieve this?

Accepted Answer

Enable encryption when creating the DB instance using a customer-managed KMS key.. Options A and B are correct because enabling encryption at launch is the standard method, and using KMS with a custom key provides customer-managed encryption. Option C is wrong because you cannot enable encryption on an unencrypted DB instance after launch. Option D is wrong because the default RDS encryption uses KMS even with the AWS managed key. Option E is wrong because client-side encryption is not a feature of RDS; it would need application-level changes.

Answer

Use the default RDS encryption with a customer-managed key without KMS.

Answer

Enable encryption on an existing unencrypted DB instance by modifying the instance.

Answer

Use client-side encryption with the RDS SDK.

Question 7

The IAM policy above is attached to a user. The user tries to stop an EC2 instance. What will happen?

Accepted Answer

The user can stop the instance.. Option A is correct because the policy explicitly allows ec2:StopInstances and does not deny it. Option B is wrong because there is no explicit deny for StopInstances. Option C is wrong because the deny only applies to TerminateInstances. Option D is wrong because the policy allows StopInstances.

Answer

The user is denied due to an implicit deny.

Answer

The user cannot stop the instance because there is no explicit allow for all instances.

Answer

The user cannot stop the instance because the Deny statement overrides the Allow.

Question 8

A DevOps engineer runs the command above and gets the output shown. The engineer then tries to delete a versioned object from the bucket without using MFA. What will happen?

Accepted Answer

The delete request will fail with an AccessDenied error.. Option C is correct because MFA Delete is enabled, so deleting a versioned object requires MFA. Option A is wrong because versioning is enabled, so objects are not permanently deleted without MFA. Option B is wrong because even though MFA Delete is enabled, it does not prevent listing. Option D is wrong because the delete will fail without MFA.

Answer

The object will be permanently deleted.

Answer

The object will be deleted but can be recovered from the 'Delete Markers' list.

Answer

The object will be deleted and a new version will be created.

Question 9

The AWS Config rule 's3-bucket-ssl-requests-only' returns NON_COMPLIANT for the bucket 'my-bucket'. What does this mean?

Accepted Answer

The bucket's policy does not deny requests that are not using SSL.. Option B is correct because the rule checks that bucket policies deny HTTP requests. Option A is wrong because the rule checks the bucket policy, not encryption. Option C is wrong because the rule checks for SSL, not logging. Option D is wrong because the rule does not check public access.

Answer

The bucket is publicly accessible.

Answer

The bucket does not have server access logging enabled.

Answer

The bucket does not have default encryption enabled.

Question 10

A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service should be used to implement this rotation?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager allows automatic rotation of secrets, including IAM user access keys, with a customizable rotation period. Option B is correct because AWS Secrets Manager directly supports this use case. Option A (AWS Systems Manager Parameter Store) cannot rotate credentials. Option C (AWS Lambda) could be used but is not the primary service. Option D (AWS Config) is for compliance checking, not rotation.

Answer

AWS Lambda with custom rotation logic

Answer

AWS Config

Answer

AWS Systems Manager Parameter Store

Question 11

A company needs to audit all changes to security groups in a multi-account environment. The logs must be centrally stored and immutable. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Enable AWS CloudTrail in all accounts, deliver logs to a central S3 bucket with S3 Object Lock enabled. AWS CloudTrail logs all API calls, including security group changes. Sending CloudTrail logs from all accounts to a central S3 bucket with Object Lock enabled ensures immutability. Option A is correct. Option B (AWS Config) records state changes but not API calls. Option C (VPC Flow Logs) logs network traffic, not security group changes. Option D (Amazon GuardDuty) is for threat detection.

Answer

Enable VPC Flow Logs in each VPC and aggregate them in Amazon CloudWatch Logs

Answer

Enable Amazon GuardDuty and send findings to a central S3 bucket

Answer

Enable AWS Config rules to detect security group changes and store results in a central S3 bucket

Question 12

A DevOps engineer needs to grant cross-account access to an S3 bucket. The source account is 111111111111 and the target account is 222222222222. Which combination of a bucket policy and an IAM policy correctly grants the target account access?

Accepted Answer

Bucket policy: { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::222222222222:root" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" }. Cross-account S3 access requires a bucket policy in the source account that grants permissions to the target account's root or a specific role, and an IAM policy in the target account that allows the user to access the bucket. Option A is correct. Option B is missing the bucket policy. Option C is missing the IAM policy. Option D uses an incorrect syntax.

Answer

Bucket policy: { "Effect": "Allow", "Principal": "222222222222", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } and IAM policy: same as A

Answer

Only bucket policy as in A

Answer

Only IAM policy as in A

Question 13

Given the above AWS CLI command output, which actions are allowed for the specified policy?

Accepted Answer

ec2:DescribeInstances and s3:GetObject are allowed; s3:ListBucket is denied. The simulate-custom-policy command tests the specified policy against the given actions and resources. For ec2:DescribeInstances, the action is allowed (ec2:Describe* covers it). For s3:GetObject, the action is allowed. For s3:ListBucket, the action is not allowed because the policy only allows s3:GetObject, not s3:ListBucket. So two actions are allowed. Option A is correct.

Answer

Only s3:GetObject is allowed

Answer

Only ec2:DescribeInstances is allowed

Answer

All three actions are allowed

Question 14

A company has an Amazon RDS for MySQL database that stores sensitive data. The security team requires encryption at rest and in transit. Which combination of options meets these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance and enforce SSL connections. Encryption at rest is enabled by enabling RDS encryption. Encryption in transit is achieved by using SSL/TLS connections. Option A is correct. Option B (AWS KMS with client-side encryption) would encrypt data before sending but does not use RDS encryption. Option C (VPC peering) does not encrypt. Option D (AWS Certificate Manager) is for certificates but not directly for RDS encryption.

Answer

Use AWS Certificate Manager to issue a certificate for the RDS instance

Answer

Place the RDS instance in a private subnet and use VPC peering

Answer

Use AWS KMS to encrypt the database before inserting data and decrypt on read

Question 15

An S3 bucket has the above bucket policy. What is the effect of this policy?

Accepted Answer

It denies access to the bucket if the request is not sent over HTTPS. The policy denies all S3 actions when aws:SecureTransport is false, i.e., when the request is not using HTTPS. This effectively enforces HTTPS for all access to the bucket. Option A is correct. It does not allow anonymous access (B). It does not deny all access (C). It does not allow only specific IPs (D).

Answer

It allows anonymous access to the bucket over HTTPS

Answer

It denies all access to the bucket regardless of protocol

Answer

It allows access only from specific IP addresses