DOP-C02 Security and Compliance Practice Test 16 — 15 Questions

Question 1

A company has a VPC with public and private subnets. An EC2 instance in the private subnet needs to download patches from the internet but must not be directly accessible from the internet. Which configuration allows this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a NAT gateway in a public subnet and route the private subnet's traffic through it.. A NAT gateway deployed in a public subnet allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet. This matches the requirement for downloading patches without direct accessibility. Option B is correct. Option A is incorrect because a VPN connection provides access to an on-premises network, not general internet access. Option C is incorrect because a bastion host provides SSH/RDP access to instances, not outbound internet connectivity for patch downloads. Option D is incorrect because attaching an internet gateway and adding a route to the private subnet route table would make the instances directly accessible from the internet, violating the requirement.

Answer

Set up a VPN connection to the company's on-premises network and route traffic through it.

Answer

Deploy a bastion host in the public subnet and configure the instance to use it.

Answer

Attach an internet gateway to the VPC and add a route to the private subnet route table.

Question 2

A company uses AWS CodeBuild for CI/CD. The build project needs to access a private S3 bucket to download artifacts. What is the MOST secure way to grant access?

Accepted Answer

Create an IAM role with read access to the bucket and attach it to the CodeBuild project.. Attaching an IAM role to the CodeBuild project allows CodeBuild to assume temporary credentials via the AWS STS service, eliminating the need to store any long-lived secrets. The role's policy can be scoped to only the specific S3 bucket and actions required, following least privilege. This is the AWS-recommended pattern for service-to-service authentication.

Answer

Embed the access keys in the buildspec.yml file.

Answer

Use an S3 bucket policy that grants public read access.

Answer

Store AWS access keys in CodeBuild environment variables.

Question 3

An organization has a compliance requirement to automatically detect and alert on any IAM user creation in all AWS accounts. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events. AWS CloudTrail captures all IAM user creation events as `CreateUser` API calls. Amazon CloudWatch Events (now Amazon EventBridge) can be configured with a rule that matches this specific event pattern and triggers an alert via Amazon SNS. This combination provides real-time detection and notification without custom code.

Answer

Amazon GuardDuty and Amazon SNS

Answer

Amazon S3 server access logs and Amazon Athena

Answer

AWS Config and AWS Lambda

Question 4

A company's security team suspects that an attacker has compromised an IAM user's access keys. The keys were used to launch instances in an unauthorized region. What is the FASTEST way to mitigate the threat?

Accepted Answer

Rotate the access keys immediately.. Rotating the access keys immediately invalidates the compromised keys, preventing further unauthorized use without disrupting the IAM user's other permissions or requiring a full user recreation. This is the fastest mitigation because it directly revokes the attacker's access while allowing the legitimate user to continue using new keys after rotation.

Answer

Delete the IAM user.

Answer

Change the IAM user's password.

Answer

Attach an AWS WAF to block the attacker's IP address.

Question 5

A company's security policy requires that all data stored in Amazon S3 must be encrypted at rest using server-side encryption with customer-managed keys (SSE-KMS). When uploading an object via the AWS CLI, which parameter must be included to enforce this?

Accepted Answer

--server-side-encryption aws:kms. The correct parameter to enforce server-side encryption with AWS KMS (SSE-KMS) when uploading an object via the AWS CLI is --server-side-encryption aws:kms, which corresponds to option D. Option A is incorrect because --kms-key-id only specifies the key ID but does not enable encryption by itself; it must be combined with --server-side-encryption aws:kms. Option B is incorrect because --sse AES256 is not a valid AWS CLI parameter; the correct parameter for SSE-S3 is --server-side-encryption AES256. Option C is incorrect because --encryption is not a valid AWS CLI parameter for server-side encryption.

Answer

--kms-key-id <key-id>

Answer

--sse AES256

Answer

--encryption aws:kms

Question 6

Which TWO actions are effective ways to protect an AWS account root user? (Choose 2)

Accepted Answer

Enable multi-factor authentication (MFA) on the root user.. Option C is correct because enabling MFA on the root user adds a second authentication factor, so a compromised password alone cannot be used to sign in to the highly privileged root account. Option E is correct because root user access keys grant programmatic access with full account privileges, and AWS best practice is to delete them or, if they cannot be deleted, disable and rotate them so they cannot be abused. Options A and D are not the recommended controls: AWS does not require or recommend periodic root password rotation as a primary protection, and password complexity alone does not mitigate credential theft. Option B is incorrect because using the root user for everyday administrative tasks violates least privilege and greatly increases the blast radius of a compromise; instead, create IAM users or roles with the needed permissions.

Answer

Use a strong, complex password and change it every 90 days.

Answer

Use the root user for everyday administrative tasks.

Answer

Rotate the root user password every 30 days.

Question 7

Which THREE are features of AWS Key Management Service (KMS) that help with compliance requirements? (Choose 3)

Accepted Answer

Automatic key rotation every year (optional).. AWS KMS supports optional automatic annual key rotation for customer managed keys. This helps meet compliance frameworks (e.g., PCI DSS, SOC, HIPAA) that require periodic cryptographic key rotation to limit the amount of data encrypted under a single key. When enabled, KMS automatically rotates the key material once per year, creating a new backing key while retaining the old one for decryption of previously encrypted data.

Answer

Automatic password generation for databases.

Answer

Automatic deletion of keys after a specified period.

Question 8

Which TWO are best practices for securing an Amazon RDS database? (Choose 2)

Accepted Answer

Launch the RDS instance in a private subnet.. Option C is correct because launching the RDS instance in a private subnet removes it from the public internet, so only resources inside the VPC (or connected via VPN/Direct Connect or a bastion) can reach the database endpoint, which is a core network-isolation best practice. Option D is correct because enabling encryption at rest with AWS KMS protects stored data, automated backups, read replicas, and snapshots, satisfying compliance and data-protection requirements. Option A is wrong because public accessibility exposes the database to internet-based attacks and is not recommended; management should be done via private networking or a bastion. Option B is wrong because a Single-AZ deployment creates a single point of failure and does not improve security; Multi-AZ is preferred for availability. Option E is wrong because granting direct IAM user access to the database bypasses proper database authentication and least-privilege controls; IAM should be used for AWS API access, not direct DB logins.

Answer

Enable public accessibility for easy management.

Answer

Use a single Availability Zone to reduce complexity.

Answer

Grant direct IAM user access to the database.

Question 9

A company uses AWS Organizations with SCPs to restrict access to services. The security team needs to ensure that no IAM user or role in any account can create or modify VPCs. Which SCP should be applied to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}. It denies both the ec2:CreateVpc and ec2:ModifyVpc actions, which covers all operations that could create or modify VPCs. A service control policy (SCP) with a Deny effect overrides any Allow permissions, ensuring that no IAM user or role in any account under the root OU can perform these actions, even if attached IAM policies grant them.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifyVpc","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateVpc","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["ec2:CreateVpc","ec2:ModifyVpc"],"Resource":"*"}]}

Question 10

A DevOps engineer is configuring AWS CloudTrail to log all management events across all regions. The engineer wants to ensure that log files are encrypted at rest using a customer-managed KMS key. What is the correct way to achieve this?

Accepted Answer

Specify a KMS key ID in the CloudTrail trail configuration and grant CloudTrail permissions to use the key.. AWS CloudTrail supports encryption at rest using a customer-managed AWS KMS key (SSE-KMS). To achieve this, you must specify the KMS key ID in the CloudTrail trail configuration and grant CloudTrail permissions to use that key via the key policy. Option A is wrong because CloudTrail does not support SSE-C (customer-provided keys); it only supports SSE-S3 or SSE-KMS. Option B is wrong because client-side encryption is not a built-in CloudTrail feature and would require custom implementation. Option C is wrong because SSE-S3 uses S3-managed keys, not a customer-managed KMS key. Therefore, D is the only correct way to encrypt CloudTrail logs with a customer-managed KMS key.

Answer

Use SSE-C with a customer-provided key when uploading logs to S3.

Answer

Enable client-side encryption before delivering logs to S3.

Answer

Enable default encryption on the S3 bucket using SSE-S3.

Question 11

A company uses AWS CodePipeline to deploy a web application to an Auto Scaling group. The security team requires that all artifacts in the pipeline be encrypted at rest. The pipeline uses an S3 bucket as the artifact store. Which combination of actions should the DevOps engineer take to meet this requirement with minimal operational overhead?

Accepted Answer

Enable S3 default encryption with SSE-S3 on the artifact bucket.. Enabling S3 default encryption with SSE-S3 on the artifact bucket is the simplest way to encrypt all objects at rest with minimal operational overhead. SSES3 uses S3-managed keys, requiring no additional key management or permissions. Option A is wrong because AWS Certificate Manager provides TLS certificates, not encryption for S3 objects. Option C is wrong because using a Lambda function to encrypt artifacts after each stage adds unnecessary complexity and does not automatically encrypt all artifacts, especially existing ones. Option D is wrong because creating a customer-managed KMS key introduces additional overhead for key management and permissions, which is not minimal.

Answer

Use AWS Certificate Manager to encrypt the artifacts.

Answer

Use an AWS Lambda function to encrypt artifacts after each pipeline stage.

Answer

Create a customer-managed KMS key and configure the pipeline to use it for artifact encryption.

Question 12

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The pipeline must scan container images for vulnerabilities before deploying to Amazon ECS. Which service should the engineer use to perform the vulnerability scan?

Accepted Answer

Amazon ECR image scanning. Amazon ECR image scanning is the correct service to perform vulnerability scans on container images before deployment to Amazon ECS. ECR provides both basic and enhanced scanning (using Amazon Inspector) that can identify vulnerabilities in container images. This integrates seamlessly with CI/CD pipelines to scan images as part of the build process.

Answer

AWS WAF

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

An organization uses AWS Key Management Service (KMS) with customer-managed keys. The security policy requires automatic key rotation every year. A DevOps engineer notices that the key material is not rotating as expected. What is the most likely cause?

Accepted Answer

The key was created by importing key material; automatic rotation is not supported for imported keys.. Automatic key rotation is not supported for imported key material. Option B is wrong because KMS does not charge extra for automatic rotation. Option C is wrong because KMS does not require re-importing for rotation; it's simply not available. Option D is wrong because the key state does not prevent rotation.

Answer

The key must be re-imported annually to enable rotation.

Answer

The key is not enabled for rotation due to a billing limit.

Answer

The key is in a 'Pending Deletion' state and cannot be rotated.

Question 14

A DevOps engineer is troubleshooting a failed CodeBuild project. The build fails with an error: 'Access Denied: Unable to put object to S3.' The build project has an S3 bucket as the artifact store. What should the engineer do to resolve this issue?

Accepted Answer

Add s3:PutObject permission to the CodeBuild service role for the artifact bucket.. The error 'Access Denied: Unable to put object to S3' indicates the CodeBuild service role lacks s3:PutObject permission on the artifact bucket. CodeBuild assumes this role to upload build artifacts, so the fix is to attach an IAM policy granting s3:PutObject (and typically s3:GetBucketLocation, s3:ListBucket) for the artifact bucket to the CodeBuild service role.

Answer

Enable server-side encryption on the artifact bucket.

Answer

Enable CloudWatch Logs for the build project.

Answer

Add s3:GetObject permission to the CodeBuild service role for the source bucket.

Question 15

An organization wants to enforce that all Amazon S3 buckets are encrypted with SSE-S3. Which AWS service can be used to automatically remediate non-compliant buckets?

Accepted Answer

AWS Config rules with auto-remediation. AWS Config rules can evaluate whether S3 buckets have SSE-S3 encryption enabled and trigger automatic remediation actions via SSM Automation documents. This provides continuous compliance monitoring and enforcement without manual intervention, directly addressing the requirement to automatically remediate non-compliant buckets.

Answer

AWS CloudTrail

Answer

IAM policies

Answer

AWS Service Catalog